WO2018214424A1 - 一种监测数据流量的方法、装置及系统 - Google Patents

一种监测数据流量的方法、装置及系统 Download PDF

Info

Publication number
WO2018214424A1
WO2018214424A1 PCT/CN2017/111606 CN2017111606W WO2018214424A1 WO 2018214424 A1 WO2018214424 A1 WO 2018214424A1 CN 2017111606 W CN2017111606 W CN 2017111606W WO 2018214424 A1 WO2018214424 A1 WO 2018214424A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
data traffic
traffic
value
monitored
Prior art date
Application number
PCT/CN2017/111606
Other languages
English (en)
French (fr)
Inventor
顾明伟
马智勇
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17911049.9A priority Critical patent/EP3641222B1/en
Priority to JP2019564804A priority patent/JP6889784B2/ja
Priority to KR1020197036914A priority patent/KR102397346B1/ko
Publication of WO2018214424A1 publication Critical patent/WO2018214424A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/18—Protocol analysers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/028—Capturing of monitoring data by filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0686—Additional information in the notification, e.g. enhancement of specific meta-data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/026—Capturing of monitoring data using flow identification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0823—Errors, e.g. transmission errors
    • H04L43/0847—Transmission error
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a method, device, and system for monitoring data traffic. More specifically, the present application relates to the detection and processing of misidentification of data traffic associated with the type of protocol being monitored.
  • IP Internet Protocol
  • the user equipment accesses a server located on the other side of the IP network through a wireless access device or a wired access device provided by the communication carrier to obtain a corresponding service.
  • P2P Point-to-Point
  • online games and Internet telephony has brought a large number of users to communication operators. It also brings more challenges. For example, applications based on P2P services often “greedy” encroachment on network resources, occupying a large amount of Internet traffic, resulting in different degrees of network congestion, thereby greatly reducing the user experience of other applications.
  • SA Service Awareness
  • the SA device provides accurate identification and deep information extraction capabilities for data traffic.
  • the SA device recognizes the data traffic associated with the protocol type, resulting in failure of data traffic control behavior or incorrect data traffic accounting, which is caused by the interests of the communication carrier. Loss reduces the user's online experience.
  • the embodiments of the present application provide a method, an apparatus, and a system for monitoring data traffic, which are applied in an application scenario in which a user equipment accesses an IP network through a device provided by a communication carrier.
  • the monitoring device monitors the data traffic associated with the type of protocol to be monitored, and triggers a corresponding identification error protection action, which helps to reduce the loss of the communication operator's interests and improve the user's online experience.
  • a method of monitoring data traffic collects the data traffic associated with the protocol type to be monitored in the data traffic of the user equipment or the IP network according to the type of the protocol to be monitored, to obtain the first data traffic, and the protocol type to be monitored is used to indicate the data. Traffic-related applications. And the monitoring device acquires the traffic information of the first data traffic, where the traffic information of the first data traffic includes a first data volume, where the first data volume is used to indicate all the reports in the first data traffic. The sum of the lengths of the text. The monitoring device determines, according to the traffic information of the first data traffic, whether the first data traffic associated with the protocol type to be monitored has an identification error.
  • the monitoring device determines that the first data traffic associated with the protocol type to be monitored has an identification error
  • the monitoring device triggers an identification error protection action.
  • the traffic information of the first data traffic further includes a first user quantity, where the first user quantity is used to indicate the number of users associated with the first data traffic.
  • the monitoring device determines, according to the traffic information of the first data traffic, whether the first data traffic associated with the protocol type to be monitored has an identification error.
  • the monitoring device determines that there is an identification error in the first data traffic associated with the protocol type to be monitored, the monitoring device triggers an identification error protection action. Therefore, the monitoring device monitors the data traffic associated with the protocol type to be monitored, and triggers a corresponding identification error protection action, which helps reduce the loss of the communication operator's interests and improves the user's online experience.
  • the monitoring by using the traffic information of the first data traffic, determining whether the first data traffic associated with the protocol type to be monitored has an identification error, includes: Determining, by the monitoring device, that the absolute value of the deviation rate of the value of the flow information of the first data traffic relative to the first threshold is greater than the first predetermined deviation rate, determining the first data traffic associated with the protocol type to be monitored There is an identification error, and the first threshold is a preset value.
  • the monitoring device collects, according to the type of the protocol to be monitored, the data traffic associated with the protocol type to be monitored in the data traffic of the user equipment or the IP network, to obtain the first
  • the data traffic includes: the monitoring device collects data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network corresponding to the first predetermined time according to the type of the protocol to be monitored, and obtains the data traffic.
  • the first data traffic is described.
  • the method further includes: collecting, by the monitoring device, data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network corresponding to the second predetermined time according to the protocol type to be monitored Obtaining a second data flow, wherein the first predetermined time and the second predetermined time are the same time of different dates.
  • the monitoring device acquires the traffic information of the second data traffic, the traffic information of the second data traffic includes a second data volume, and the second data volume is used to indicate all the packets in the second data traffic. The sum of the lengths.
  • Determining, by the monitoring device, whether the second data traffic associated with the protocol type to be monitored has an identification error according to an absolute value of a deviation rate of the value of the traffic information of the second data traffic with respect to the second threshold The second threshold is a value of the traffic information of the first data traffic.
  • the monitoring device determines the number associated with the protocol type to be monitored There is a recognition error in the data traffic.
  • the monitoring device determines that there is an identification error in the second data traffic associated with the protocol type to be monitored, the monitoring device triggers an identification error protection action.
  • the monitoring device collects, according to the type of the protocol to be monitored, the data traffic associated with the protocol type to be monitored in the data traffic of the user equipment or the IP network, to obtain the first
  • the data traffic includes: the monitoring device collects, according to the type of the protocol to be monitored, the data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network corresponding to the first predetermined time interval, and obtains The first data traffic.
  • the method further includes: the monitoring device collecting, according to the protocol type to be monitored, data associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network corresponding to the second predetermined time interval.
  • the monitoring device acquires the traffic information of the second data traffic, the traffic information of the second data traffic includes a second data volume, and the second data volume is used to indicate all the packets in the second data traffic. The sum of the lengths.
  • Second threshold The value is the value of the traffic information of the first data traffic.
  • the monitoring device determines the number associated with the protocol type to be monitored There is a recognition error in the data traffic.
  • the monitoring device determines that there is an identification error in the second data traffic associated with the protocol type to be monitored, the monitoring device triggers an identification error protection action.
  • the method further includes: when an absolute value of a value of the flow rate information of the second data traffic with respect to the second threshold is less than or equal to the The second predetermined deviation rate, the monitoring device determines that the second data traffic associated with the protocol type to be monitored does not have an identification error. When the monitoring device determines that the second data traffic associated with the protocol type to be monitored does not have an identification error, the monitoring device updates the second threshold to a value of the traffic information of the second data traffic. And an average of the values of the flow information of the first data flow.
  • the absolute value of the deviation rate of the value of the flow rate information of the first data flow with respect to the first threshold is specifically: an absolute value of a deviation rate of the value of the first data quantity relative to the first data quantity threshold Multiplied by the absolute value of the first weight and the value of the first user amount relative to the first user amount threshold multiplied by the sum of the second weights, wherein the first threshold includes the first data amount threshold And the first user amount threshold, the sum of the first weight and the second weight is 1.
  • the traffic information of the second data traffic further includes a second user quantity, where the second user quantity is used to indicate the number of users associated with the second data traffic.
  • the absolute value of the deviation rate of the value of the flow rate information of the second data flow with respect to the second threshold is specifically: the absolute value of the deviation rate of the value of the second data amount relative to the second data amount threshold multiplied by the first And a weight of the second user amount threshold value and the second user amount threshold value a second user quantity threshold, the second data quantity threshold is a value of a first data quantity of the first data flow, and the second user quantity threshold is a value of a first user quantity of the first data flow, The sum of the first weight and the second weight is 1.
  • the absolute value of the deviation rate of the value of the traffic information of the second data traffic with respect to the second threshold is specifically: an absolute value of a deviation rate of the value of the second data amount relative to the second data amount threshold Multiplying the absolute value of the deviation rate of the first weight and the value of the second user amount with respect to the second user amount threshold by the sum of the second weights, wherein the second threshold includes the second data amount threshold And the second user amount threshold, the second data amount threshold is a value of a first data amount of the first data traffic, and the second user amount threshold is a first user amount of the first data traffic The value of the first weight and the second weight is 1.
  • the monitoring device updates the second threshold to an average value of the value of the traffic information of the second data traffic and the value of the traffic information of the first data traffic, specifically: the monitoring device will be the second
  • the data amount threshold is updated to an average of a value of the second data amount of the second data flow and a value of the first data amount of the first data flow
  • the monitoring device sets the second user amount threshold Updating to an average of the value of the second user amount of the second data traffic and the value of the first user amount of the first data traffic.
  • the identifying error protection action includes at least one of the following actions: alarm, traffic release, traffic limiting, and traffic blocking.
  • a monitoring device for monitoring data flow having the function of implementing the behavior of the monitoring device in the above method.
  • the functions may be implemented based on hardware, or may be implemented based on hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the structure of the monitoring device includes a processor and an interface configured to support the monitoring device to perform the corresponding functions of the above methods.
  • the interface is configured to support the monitoring device to communicate with the user equipment and the IP network, send the information or instructions involved in the foregoing method to the user equipment and the IP network, or receive the information involved in the foregoing method from the user equipment and the IP network or instruction.
  • the monitoring device can also include a memory for coupling with the processor that retains the program instructions and data necessary to monitor the device.
  • the monitoring device includes a processor, a transmitter, a random access memory, a read only memory, and a bus.
  • the processor is respectively coupled to the transmitter, the random access memory, and the read only memory through a bus.
  • the basic input/output system solidified in the read-only memory or the bootloader guiding system in the embedded system is started to guide the monitoring device to enter a normal operating state.
  • the application and operating system are run in a random access memory such that the processor performs the method of the first aspect or any possible implementation of the first aspect.
  • a system for monitoring data traffic comprising a monitoring device, the monitoring device being the monitoring device of the aforementioned second aspect.
  • a computer storage medium for storing a program, code or instruction used by the monitoring device, and when the processor or the hardware device executes the program, code or instruction, the function of the monitoring device in the above aspect can be completed. Or steps.
  • the monitoring device collects the association of the protocol type to be monitored in the data traffic from the user equipment or the IP network according to the type of the protocol to be monitored.
  • Data traffic getting the first data traffic.
  • the monitoring device acquires the traffic information of the first data traffic, where the traffic information of the first data traffic includes a first data volume, where the first data volume is used to indicate all the packets in the first data traffic. The sum of the lengths.
  • the monitoring device determines, according to the traffic information of the first data traffic, whether the first data traffic associated with the protocol type to be monitored has an identification error.
  • the monitoring device determines that there is an identification error in the first data traffic associated with the protocol type to be monitored, the monitoring device triggers an identification error protection action. Therefore, the monitoring device monitors the data traffic associated with the protocol type to be monitored, and triggers a corresponding identification error protection action, which helps reduce the loss of the communication operator's interests and improves the user's online experience.
  • FIG. 1 is a schematic structural diagram of a network according to an embodiment of the present application.
  • FIG. 2 is a flowchart of a method for monitoring data traffic according to an embodiment of the present application
  • FIG. 3 is a schematic structural diagram of a monitoring apparatus according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of hardware of a monitoring apparatus according to an embodiment of the present application.
  • the embodiment of the present application provides a method, a device, and a system for monitoring data traffic, which are applied in an application scenario in which a user equipment accesses an IP network through a device provided by a communication carrier.
  • the monitoring device monitors the data traffic associated with the type of protocol to be monitored, and triggers a corresponding identification error protection action, which helps to reduce the loss of the communication operator's interests and improve the user's online experience.
  • FIG. 1 is a schematic structural diagram of a network according to an embodiment of the present application.
  • a user can access a network resource located on the other side of the IP network via an IP network using a user equipment.
  • network resources can provide services such as web browsing, data downloading, and data uploading.
  • the user can also use the user equipment to be located on the IP network via the IP network.
  • the other side of the user communicates video, voice, and instant messaging.
  • the user equipment can communicate with the IP network through a wireless network or a wired broadband network.
  • the network structure further includes a base station and a gateway GPRS support node (English: Gateway GPRS Support Node, abbreviation: GGSN), where GPRS is a general packet radio service (English: General Packet Radio Service).
  • GGSN Gateway GPRS Support Node
  • GPRS General Packet Radio Service
  • the user equipment can communicate with the IP network via the base station and the GGSN.
  • the network structure further includes a broadband access server (English: Broadband Access Server, abbreviated as: BAS).
  • BAS Broadband Access Server
  • the user equipment can communicate with the IP network via the BAS.
  • the GGSN and the BAS may be routers.
  • the user equipment may be at least one of the following: a smart phone, a personal digital assistant (English: Personal Digital Assistant, PDA), and an IP-based voice transmission (English: Voice over Internet Protocol, VoIP). Network equipment, portable computers, desktop computers, etc.
  • the network structure further includes a traffic analysis management system.
  • the traffic analysis management system is deployed on a communication link between the GGSN and the IP network, or the traffic analysis management system is deployed on a communication link between the BAS and the IP network, or the GGSN and the BAS device Communicate with the IP network via the same traffic analysis management system.
  • the traffic analysis management system implements analysis of data traffic from the user equipment to the IP network or data traffic from the IP network to the user equipment, and implements data traffic from the user equipment to the IP network or from the IP network according to the analysis result. Management of data traffic of user equipment.
  • the traffic analysis management system can include an SA device and a monitoring device.
  • the SA device provides accurate identification and deep information extraction capabilities for data traffic.
  • the SA device obtains a protocol type in the data traffic, and compares the protocol type in the acquired data traffic with the protocol type saved by the SA device, so as to identify which protocol type the protocol type in the acquired data traffic belongs to. .
  • the SA device may identify the data traffic associated with the protocol type. For example, the version of the application software has been updated, but the characteristics of the protocol type saved in the SA device are not updated in time.
  • the SA device identifies the updated version of the application software to send data traffic, the SA device identifies the data traffic as an unknown protocol type or Recognized as another protocol type.
  • the data traffic sent by the user equipment is abnormal traffic, causing the SA device to identify the data traffic as an unknown protocol type or as another protocol type.
  • Such identification errors will result in failure of data flow control behavior or data flow accounting errors.
  • the monitoring apparatus can implement the monitoring of the above identification error, and trigger the identification error protection action according to the presence of the above identification error.
  • the monitoring device collects data traffic associated with the protocol type to be monitored in the data traffic of the user equipment or the IP network according to the type of the protocol to be monitored, to obtain the first data traffic.
  • the monitoring device acquires the traffic information of the first data traffic, where the traffic information of the first data traffic includes a first data volume, where the first data volume is used to indicate all the packets in the first data traffic. The sum of the lengths.
  • the monitoring device determines, according to the traffic information of the first data traffic, whether the first data traffic associated with the protocol type to be monitored has an identification error.
  • the monitoring device determines that there is an identification error in the first data traffic associated with the protocol type to be monitored, the monitoring device triggers an identification error protection action.
  • all functions of the monitoring device are integrated in the SA device.
  • part of the functions of the monitoring device are integrated in the SA device, that is, the following functions implemented by the monitoring device are integrated in the SA device: according to the to-be-monitored
  • the protocol type collects the data traffic associated with the protocol type to be monitored in the data traffic of the user equipment or the IP network, to obtain the first data traffic; the monitoring device acquires the traffic information of the first data traffic, the first The traffic information of the data traffic includes a first amount of data, and the first amount of data is used to indicate a sum of lengths of all the packets in the first data traffic.
  • the monitoring device The implementation is implemented by a hardware device that is independent of the SA device. For a specific implementation and deployment manner of the monitoring device, refer to the subsequent explanation and description of the embodiments of the present application.
  • the network structure shown in FIG. 1 exemplarily shows an application scenario of the monitoring apparatus of the present application.
  • the monitoring device can be applied to various application scenarios that need to analyze and manage data traffic.
  • the monitoring device is applied in an intranet of an enterprise to implement analysis and management of data traffic within the enterprise.
  • the monitoring device is applied in a scenario of data traffic exchange between operators to implement analysis and management of interaction traffic between operators.
  • the monitoring device collects the data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network according to the type of the protocol to be monitored, to obtain the first data traffic.
  • the monitoring device acquires the traffic information of the first data traffic, and the monitoring device determines, according to the traffic information of the first data traffic, whether the first data traffic associated with the protocol type to be monitored exists error.
  • the monitoring device determines that there is an identification error in the first data traffic associated with the protocol type to be monitored, the monitoring device triggers an identification error protection action. Therefore, the monitoring device monitors the data traffic associated with the protocol type to be monitored, and triggers a corresponding identification error protection action, which helps reduce the loss of the communication operator's interests and improves the user's online experience.
  • FIG. 2 is a flowchart of a method for monitoring data traffic according to an embodiment of the present application.
  • the method shown in FIG. 2 can be applied to the network structure shown in FIG. 1.
  • the method includes:
  • the monitoring device collects data traffic associated with the protocol type to be monitored in the data traffic of the user equipment or the IP network according to the type of the protocol to be monitored, to obtain the first data traffic.
  • the user equipment may send data traffic to the IP network, and the user equipment may also receive data traffic from the IP network.
  • the user equipment sends data traffic to the IP network as an example for description.
  • the monitoring device receives data traffic from the user equipment, and the user equipment may be one or more.
  • One user can correspond to one user equipment, or one user can correspond to multiple user equipments. For example, two user equipments share a user account to communicate with the IP network.
  • the monitoring device can include a feature library that holds a protocol type to be monitored and a corresponding identification feature, wherein the identification feature includes an identification feature of a protocol type used by the application software.
  • the type of protocol to be monitored refers to the type of protocol that needs to be monitored using the monitoring device. Table 1 below shows the 17 major types of protocol types that are commonly used.
  • each of the large class protocol types may also include several small class protocol types, so that the monitoring device can monitor with a finer-grained small class protocol type.
  • data traffic associated with the P2P protocol and the Video protocol needs to be collected, that is, the types of protocols to be monitored are P2P protocol and Video protocol.
  • the monitoring device collects the data traffic associated with the P2P protocol and the data traffic associated with the Video protocol in the data traffic from the user equipment according to the P2P protocol and the Video protocol. Specifically, the monitoring device analyzes the identification feature of the data traffic from the user equipment, and compares with the identification feature in the feature database to determine a corresponding protocol type, and the data traffic from the user equipment belongs to the protocol type. The traffic data is collected. Since the feature library holds the identification feature of the protocol type of the application software corresponding to the protocol type to be monitored, the protocol type to be monitored is used to indicate the application of the data traffic association.
  • the protocol type to be monitored and the corresponding identification feature saved in the feature library may be set in a static configuration manner, or the monitoring device may request the SA device to deliver the feature.
  • the type of protocol to be monitored and the corresponding identification features stored in the library may be implemented by an SA device, and the monitoring device may The feature library of the SA device is directly invoked.
  • the data traffic at a certain moment may be collected to obtain the first data traffic, for example, collecting data traffic of 10:00 AM (AM indicates AM); Data traffic at a certain time interval can also be collected to obtain the first data traffic, for example, data traffic of 10:00 AM-10:05 AM is collected.
  • the monitoring device can also periodically collect data traffic, for example, collecting data traffic of 10:00 AM on March 1, 2016, and collecting data traffic of 10:00 AM on March 2, 2016. Data collection of 10:00 AM on March 3, 2016 is performed.
  • the monitoring device acquires traffic information of the first data traffic, where the traffic information of the first data traffic includes a first data volume.
  • the monitoring device obtains the first data traffic by using an acquisition process, where the first data traffic is data traffic associated with the protocol type to be monitored in the data traffic of the user equipment or the IP network.
  • the data traffic from the user equipment includes P2P data traffic, VOIP data traffic, and Video data traffic
  • the protocol type to be monitored is a Video protocol. Therefore, the first data traffic obtained by the monitoring device through the collection process includes Video data. flow.
  • the monitoring device acquires flow information of the first data traffic.
  • the traffic information of the first data traffic includes a first data amount, and the first data amount is used to indicate a sum of lengths of all the packets in the first data traffic. Said The traffic information of the first data traffic further includes a first user amount, where the first user amount is used to indicate the number of users associated with the first data traffic.
  • the monitoring device may determine the number of source IP addresses associated with the first data traffic to determine the first user amount.
  • the monitoring device may determine the first user amount by counting the number of destination IP addresses associated with the first data traffic.
  • the monitoring device may further determine the first user amount by counting the number of user accounts associated with the first data traffic.
  • the monitoring device may further determine the first user quantity by using partial information or all information of the quintuple information, where the quintuple information includes a source IP address, a destination IP address, Source port number, destination port number, and protocol number. For example, the monitoring device may determine the first user amount by counting the number of information groups formed by the source IP address and the destination IP address associated with the first data traffic, where a pair of source IP addresses and destination IP addresses determine one connection.
  • the monitoring device may determine the first user amount by counting the number of information groups formed by the source IP address, the destination IP address source port number, and the destination port number associated with the first data traffic. For another example, the monitoring device may determine the first user amount by counting the number of five-tuples associated with the first data traffic.
  • the monitoring device determines, according to the traffic information of the first data traffic, whether the first data traffic associated with the protocol type to be monitored has an identification error.
  • the monitoring device may determine, according to the first data quantity of the first data traffic, whether the first data traffic associated with the protocol type to be monitored has an identification error.
  • the monitoring device may further determine, according to the first data amount of the first data traffic and the first user quantity, whether the first data traffic associated with the protocol type to be monitored has an identification error.
  • the identification error is described by taking the flow information including the first data amount as an example.
  • the identifying error means that part of the data traffic in the data traffic associated with the protocol type is identified in the data traffic associated with other protocol types. For example, in an implementation that monitors P2P data traffic, the P2P data traffic that should be identified is 1 Gb (Gb: gigabit).
  • 0.2Gb of 1Gb P2P data traffic is recognized as Video data traffic due to version update or abnormal traffic of the application software.
  • part of the data traffic in the P2P data traffic is identified as Video data traffic, and the actually identified P2P data traffic is 0.8 Gb.
  • the identifying error is that the data traffic associated with the protocol type includes data traffic associated with other protocol types. For example, in an implementation that monitors P2P data traffic, the P2P data traffic that should be identified is 1 Gb.
  • 0.5Gb of Video data traffic is recognized as P2P data traffic.
  • the P2P data traffic includes Video data traffic identified as P2P data traffic, and the actually identified P2P data traffic is 1.5 Gb.
  • the monitoring method of the foregoing data amount may be used to monitor the change of the first user amount, and according to the first data amount and the first user amount, and the first The weight of the data amount and the weight of the first user amount finally determine whether there is an identification error.
  • the absolute value of the deviation rate of the value of the flow rate information of the first data flow with respect to the first threshold is specifically: the absolute value of the deviation rate of the value of the first data amount relative to the first data amount threshold Multiplying the absolute value of the deviation rate of the first weight and the first user amount with respect to the first user amount threshold by a sum of the second weights, wherein the first threshold includes the first data amount threshold and The first user amount threshold, the sum of the first weight and the second weight is 1.
  • the monitoring device determines the protocol type to be monitored according to the absolute value of the deviation rate of the value of the flow information of the first data traffic relative to the first threshold is greater than the first predetermined deviation rate.
  • the first data traffic has an identification error, and the first threshold is a preset value.
  • the deviation rate after taking the absolute value is greater than the first predetermined deviation rate (25%>20%). Therefore, it is determined that the first data traffic associated with the protocol type to be monitored has an identification error. Correspondingly, if the calculated deviation rate is less than or equal to the first predetermined deviation rate, it may be determined that the first data traffic associated with the protocol type to be monitored does not have an identification error.
  • the flow information includes the first data amount and the first user amount as an example. It is assumed that the monitoring device monitors that the first data volume of the first data traffic sent by the user equipment at 10:00 AM on March 1, 2016 is 5 Gb, the first user volume is 1100, and the first data traffic is P2P data traffic. Based on historical experience, when 10:00 AM is set every day, the data volume threshold of P2P data traffic is 4Gb, and the user volume threshold is 1000. Therefore, the first data volume threshold is set to 4Gb, and the first user amount threshold is set to 1000. Wherein the first threshold comprises a first data amount threshold and a first user amount threshold. The first predetermined deviation rate is set to 20%.
  • the weight of the first data amount is 0.8, and the weight of the first user quantity is 0.2.
  • the calculated deviation rate is greater than the first predetermined deviation rate (22%>20%), and therefore, it is determined that the first data flow associated with the protocol type to be monitored has an identification error.
  • the monitoring device may periodically monitor the first data traffic to determine whether there is an identification error in the first data traffic in each cycle. For example, the monitoring device monitors traffic information for the first data traffic at 10:00 AM per day. By comparing the absolute value of the deviation rate calculated every day with the first predetermined deviation rate, it is determined whether there is an identification error in the first data flow every day. For another example, the monitoring device monitors traffic information of the first data traffic corresponding to 10:00 AM-10:05 AM per day.
  • the monitoring device determines that the first data traffic associated with the protocol type to be monitored has an identification error, the monitoring device triggers an identification error protection action.
  • the identification error protection action includes at least one of the following actions: alarm, traffic release, traffic current limiting, and traffic blocking.
  • the detecting device triggering the identification error protection action includes: the monitoring device generates the alarm information, and sends the alarm information to the management device, so that the network administrator timely discovers an identification error of the first data traffic associated with the protocol type;
  • the monitoring device generates a traffic release command, a traffic restriction command or a traffic blocking command, and sends the traffic release command, the traffic restriction command or the traffic blocking command to the SA device, so that the SA device performs Traffic release, traffic limiting or traffic blocking.
  • the alarm information includes a protocol type in which data traffic identifying the error occurs.
  • the alarm information further includes a flow rate information of the data traffic or a deviation rate of the value of the traffic information of the data traffic with respect to the threshold.
  • the alarm information includes the foregoing deviation rate
  • the alarm information further includes a positive and negative flag of the deviation rate.
  • the traffic release command, the traffic current limiting command, and the traffic blocking command each include a protocol type in which data traffic identifying an error occurs.
  • determining, in S106, a value of the value of the traffic information of the first data traffic relative to the first threshold The absolute value of the difference is 25%, which is greater than the first predetermined deviation rate of 20%.
  • the monitoring device generates alarm information and transmits the alarm information to a management device.
  • the first data traffic is the directed video of the video website A
  • the operator needs to charge the directed video
  • the first threshold of the directed video is 4Gb.
  • the first data volume of the first data traffic is 1 Gb at 10:00 AM on March 1, 2016.
  • the absolute value of the deviation rate of the value of the flow rate information of the first data flow with respect to the first threshold is determined to be 75%, which is greater than the first predetermined deviation rate by 20%.
  • the monitoring device generates alarm information and transmits the alarm information to the management device to notify the management device that the identification error may cause a charging error.
  • the monitoring device sends a traffic blocking command to the SA device to notify the SA device to perform traffic blocking on the directed video.
  • the SA device limits the VOIP data traffic to 2 Gb.
  • the first data volume of the first data traffic is 5 Gb at 10:00 AM on March 1, 2016. Similar to the monitoring means of the above example, the monitoring means determines that there is an identification error in the first data flow. The reason for the sudden increase in the first data traffic may be because non-VOIP data traffic is identified as VOIP data traffic.
  • the SA device still limits the VOIP data traffic according to the method that the current limit value is 2Gb, the real VOIP data traffic may be lost.
  • the monitoring device sends an alarm to the management device, and the monitoring device further sends a traffic release command to the SA device to notify the SA device to perform traffic release on the first data traffic of the 5Gb. Therefore, the service traffic caused by the current limiting rule of the SA device is not damaged, thereby avoiding affecting the user's online experience.
  • the SA device restores the original traffic limiting rule.
  • the foregoing embodiment may be applied to a scenario in which all functions of the monitoring device are integrated in the SA device, and the foregoing S102-S108 is implemented in the SA device.
  • the SA device may be modified by means of modifying the SA device.
  • the function of the monitoring device of the present application may also be applied to a scenario in which part of the functions of the monitoring device are integrated in the SA device.
  • the monitoring device includes a monitoring module, an identification error analysis module, and an identification error protection module.
  • the monitoring module is integrated in the SA device to implement the above S102 and S104.
  • the identification error analysis module implementing the above S106 and the identification error protection module implementing the above S108 are completed by hardware independent of the SA device.
  • the SA device is connected to the hardware through a communication link.
  • the above embodiments may also be applied in a hardware device scenario independent of the SA device, and the hardware device completes the above S102-S108.
  • the monitoring device collects the data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network according to the type of the protocol to be monitored, to obtain the first data traffic.
  • the monitoring device acquires the traffic information of the first data traffic, and the monitoring device determines, according to the traffic information of the first data traffic, whether the first data traffic associated with the protocol type to be monitored exists error.
  • the monitoring device determines that there is an identification error in the first data traffic associated with the protocol type to be monitored, the monitoring device triggers an identification error protection action. Therefore, the monitoring device monitors the data traffic associated with the protocol type to be monitored, and triggers a corresponding identification error protection action, which helps reduce the loss of the communication operator's interests and improves the user's online experience.
  • the S102 includes the monitoring device, according to the type of the protocol to be monitored, collecting data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network corresponding to the first predetermined time, and obtaining The first data traffic.
  • the method for monitoring the data traffic further includes: the monitoring device collecting, according to the protocol type to be monitored, the type of the protocol to be monitored in the data traffic from the user equipment or the IP network corresponding to the second predetermined time Correlating data traffic, obtaining a second data traffic, the first predetermined time and the second predetermined time being the same time of different dates; the monitoring device acquiring the flow of the second data traffic
  • the quantity information, the flow information of the second data flow includes a second data quantity, the second data quantity is used to indicate a sum of lengths of all the messages in the second data flow; Determining, by the absolute value of the deviation rate of the value of the traffic information of the data traffic, with respect to the second threshold, whether the second data traffic associated with the protocol type to be monitored has an identification error, and the second
  • the monitoring device may collect data traffic for a predetermined time and periodically collect data traffic at the same time every day or week or month, for example, the first reservation.
  • the time is 10:00 AM on March 1, 2016, and the second scheduled time is 10:00 AM on March 2, 2016.
  • the first predetermined time is 10:00 AM on Monday of the first week
  • the second predetermined time is 10:00 AM on Monday of the second week.
  • the monitoring device may perform monitoring of the first data traffic corresponding to the first predetermined time according to the implementation manner of the foregoing S102-S108. If the monitoring device determines that the first data traffic associated with the protocol type to be monitored does not have an identification error, the monitoring device determines the value of the traffic information of the first data traffic as a second threshold for monitoring The device monitors the second traffic data at the second predetermined time according to the second threshold. The first data amount is determined as the second threshold when the flow information of the first data traffic includes the first data amount.
  • the second threshold includes a second data amount threshold and a second user amount threshold.
  • the monitoring device may acquire the second data traffic at the second predetermined time and the traffic information of the second data traffic according to the implementation manners of S102 and S104. Further, the monitoring device may determine an absolute value of a deviation rate of the value of the traffic information of the second data traffic with respect to the second threshold according to an implementation manner of S106, thereby determining the association of the protocol type to be monitored. Whether there is an identification error in the second data flow. If the absolute value of the deviation rate of the value of the flow information of the second data flow relative to the second threshold is greater than the second predetermined deviation rate, the monitoring device determines the second associated with the protocol type to be monitored There is a recognition error in the data traffic. According to the foregoing, the second threshold is a value of the traffic information of the first data traffic.
  • the second predetermined deviation rate may be the same as or different from the first predetermined deviation rate.
  • the monitoring device determines the to-be-determined The second data traffic associated with the monitored protocol type does not have an identification error; when the monitoring device determines that the second data traffic associated with the protocol type to be monitored does not have an identification error, the monitoring device The second threshold is updated to an average of the value of the flow information of the second data flow and the value of the flow information of the first data flow.
  • the type of the protocol to be monitored is a P2P protocol
  • the traffic information includes the amount of data.
  • the first data volume of the first data traffic is 4.5 Gb
  • the first scheduled time is 10:00 AM on March 1, 2016.
  • the first threshold is set to 4 Gb.
  • Both the first predetermined deviation rate and the second predetermined deviation rate are set to 20%.
  • the monitoring device determines the first amount of data as a second threshold, ie the second threshold is 4.5 Gb.
  • the monitoring device acquires the second data traffic for the protocol type of the P2P protocol to be monitored.
  • the second data volume of the second data flow is 3.8 Gb
  • the second predetermined time is 10:00 AM on March 2, 2016.
  • the monitoring device replaces the second threshold of the original 4.5 Gb with 4.15 Gb as the new second threshold.
  • the monitoring device may monitor the third data flow at the third predetermined time according to the second threshold having a value of 4.15 Gb, wherein the third predetermined time is 10:00 AM on March 3, 2016. If the third data traffic does not have an identification error, the monitoring device updates the second threshold in accordance with the method described above.
  • the traffic information of the first data traffic includes a first data volume and a first user amount
  • the traffic information of the second data traffic includes a second data volume and a second user amount
  • the absolute value of the deviation rate of the value of the flow rate information of the second data flow with respect to the second threshold is specifically: the absolute value of the deviation rate of the value of the second data amount relative to the second data amount threshold multiplied by the first And a weight of the second user amount threshold value and the second user amount threshold value a second user quantity threshold
  • the second data quantity threshold is a value of a first data quantity of the first data flow
  • the second user quantity threshold is a value of a first user quantity of the first data flow
  • the sum of the first weight and the second weight is 1.
  • the monitoring device updates the second threshold to an average value of the value of the traffic information of the second data traffic and the value of the traffic information of the first data traffic, specifically: the monitoring device Updating the second data amount threshold to an average of a value of a second data amount of the second data flow and a value of a first data amount of the first data flow, and the monitoring device will The second user amount threshold is updated to an average of the value of the second user amount of the second data traffic and the value of the first user amount of the first data traffic.
  • the type of the protocol to be monitored is a P2P protocol
  • the traffic information includes the amount of data and the amount of users.
  • the first data volume of the first data traffic is 4.5 Gb
  • the first user volume of the first data traffic is 1100
  • the first scheduled time is 10:00 AM on March 1, 2016.
  • the first data amount threshold is set to 4 Gb
  • the first user amount threshold is 1000.
  • Both the first predetermined deviation rate and the second predetermined deviation rate are set to 20%.
  • the monitoring device determines the first data amount and the first user amount as a second threshold, that is, the second data amount threshold is 4.5 Gb, and the second data user amount threshold is 1100.
  • the monitoring device acquires the second data traffic for the protocol type of the P2P protocol to be monitored. After monitoring by the monitoring device, the second data volume of the second data traffic is 3.8 Gb, the second user volume is 980, and the second scheduled time is 10:00 AM on March 2, 2016.
  • the monitoring device replaces the original 4.5 Gb second data amount threshold with 4.15 Gb as the new second data amount threshold, and replaces the original 1100 second user amount threshold with 1040 as the new second user amount threshold.
  • the monitoring device may monitor the third data traffic at the third predetermined time according to the second data amount threshold having a value of 4.15 Gb and the second user amount threshold having a value of 1040, wherein the third scheduled time is March 3, 2016. Day 10:00AM. If the third data traffic does not have an identification error, the monitoring device updates the second threshold in accordance with the method described above.
  • the S102 includes the monitoring device, according to the type of the protocol to be monitored, collecting data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network corresponding to the first predetermined time interval, Obtaining the first data traffic.
  • the method for monitoring data traffic further includes: the monitoring device collecting, according to the protocol type to be monitored, a protocol to be monitored in data traffic from the user equipment or the IP network corresponding to a second predetermined time interval.
  • Type-associated data traffic obtaining a second data traffic, the start time of the first predetermined time interval and the start time of the second predetermined time interval being the same time of different dates, the end time of the first predetermined time interval And the end time of the second predetermined time interval is the same time of the different date; the monitoring device acquires the traffic information of the second data traffic, the traffic information of the second data traffic includes the second data volume, The second data amount is used to indicate a sum of lengths of all the packets in the second data traffic; and the monitoring device is configured to determine an absolute value of a deviation rate of the value of the traffic information of the second data traffic with respect to the second threshold.
  • the monitoring device determines whether the second data traffic associated with the protocol type to be monitored has an identification error, and the second threshold is the first a value of the flow rate information according to the flow rate; when the absolute value of the deviation rate of the flow rate information of the second data flow rate relative to the second threshold value is greater than a second predetermined deviation rate, the monitoring device determines the to-be-monitored The second data traffic associated with the protocol type has an identification error; when the monitoring device determines that the second data traffic associated with the protocol type to be monitored has an identification error, the monitoring device triggers an identification error protection action .
  • the monitoring device may collect data traffic for a predetermined time interval, and periodically collect data traffic of the same time interval every day or week or month, for example,
  • the predetermined time interval is 10:00AM-10:05AM on March 1, 2016, and the second scheduled time is 10:00AM-10:05AM on March 2, 2016.
  • the first predetermined time is 10:00 AM-10:05 AM on Monday of the first week
  • the second predetermined time is 10:00 AM-10:05 AM on Monday of the second week.
  • the implementation manner of this embodiment is different from the implementation manner of the foregoing embodiment in that the data traffic at the scheduled acquisition time is replaced with the data traffic collected for a predetermined time interval.
  • the specific implementation manner of the monitoring device to monitor the data traffic of the protocol type to be monitored refer to the foregoing embodiment, and details are not described herein.
  • FIG. 3 is a schematic structural diagram of a monitoring apparatus 1000 according to an embodiment of the present application.
  • the monitoring device 1000 shown in FIG. 3 can perform the corresponding steps performed by the monitoring device 1000 in the method of the above embodiment.
  • the monitoring device 1000 includes an acquisition unit 1002 and a processing unit 1004.
  • the collecting unit 1002 is configured to collect data traffic associated with the protocol type to be monitored in the data traffic of the user equipment or the IP network according to the type of the protocol to be monitored, to obtain the first data traffic, and the type of the protocol to be monitored.
  • the processing unit 1004 is configured to acquire the traffic information of the first data traffic, where the traffic information of the first data traffic includes a first data volume, where the first data volume is used to indicate the first data traffic. All messages The sum of the lengths;
  • the processing unit 1004 is further configured to determine, according to the traffic information of the first data traffic, whether the first data traffic associated with the protocol type to be monitored has an identification error;
  • the processing unit 1004 determines that the first data traffic associated with the protocol type to be monitored has an identification error
  • the processing unit 1004 is further configured to trigger an identification error protection action.
  • the identification error protection action includes at least one of the following actions: alarm, traffic release, traffic current limiting, and traffic blocking.
  • the processing unit 1004 is further configured to: determine, according to the traffic information of the first data traffic, whether the first data traffic associated with the protocol type to be monitored has an identification error, specifically, according to: Determining that the absolute value of the value of the flow rate of the first data flow is greater than the first predetermined deviation rate, and determining that the first data traffic associated with the protocol type to be monitored has an identification error.
  • the first threshold is a preset value.
  • the collecting unit 1002 is configured to collect, according to the type of the protocol to be monitored, the data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network, to obtain the first data traffic, specifically And: collecting, according to the type of the protocol to be monitored, the data traffic associated with the protocol type to be monitored in the data traffic of the user equipment or the IP network corresponding to the first predetermined time, to obtain the first data traffic.
  • the collecting unit 1002 is further configured to collect, according to the protocol type to be monitored, data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network corresponding to the second predetermined time, to obtain The second data flow, the first predetermined time and the second predetermined time are the same time of different dates.
  • the processing unit 1004 is further configured to acquire traffic information of the second data traffic, where the traffic information of the second data traffic includes a second data volume, where the second data volume is used to indicate the second data traffic. The sum of the lengths of all messages.
  • the processing unit 1004 is further configured to determine, according to an absolute value of a deviation rate of the value of the traffic information of the second data traffic, with respect to a second threshold, whether the second data traffic associated with the protocol type to be monitored exists. Identifying an error, the second threshold being a value of traffic information of the first data traffic.
  • the processing unit 1004 is further configured to determine the protocol type association to be monitored, when an absolute value of a value of the flow rate information of the second data flow is greater than a second predetermined deviation rate.
  • the second data traffic has an identification error. When the processing unit 1004 determines that the second data traffic associated with the protocol type to be monitored has an identification error, the processing unit 1004 is further configured to trigger an identification error protection action.
  • the collecting unit 1002 is configured to collect, according to the type of the protocol to be monitored, the data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network, to obtain the first data traffic, specifically The data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network corresponding to the first predetermined time interval is collected according to the type of the protocol to be monitored, and the first data traffic is obtained.
  • the collecting unit 1002 is further configured to collect data traffic associated with the protocol type to be monitored in the data traffic from the user equipment or the IP network corresponding to the second predetermined time interval according to the protocol type to be monitored, Obtaining a second data flow, the start time of the first predetermined time interval and the start time of the second predetermined time interval being the same time of different dates, the end time of the first predetermined time interval and the second predetermined The end time of the time interval is the same time on different dates.
  • the processing unit 1004 is further configured to acquire traffic information of the second data traffic, where the traffic information of the second data traffic includes a second data volume, where the second data volume is used to indicate the second data traffic. The sum of the lengths of all messages.
  • the processing unit 1004 is further configured to determine, according to an absolute value of a deviation rate of a value of the flow rate information of the second data traffic with respect to a second threshold. Whether the second data traffic associated with the protocol type to be monitored has an identification error, and the second threshold is a value of the traffic information of the first data traffic. The processing unit 1004 is further configured to determine the protocol type association to be monitored, when an absolute value of a value of the flow rate information of the second data flow is greater than a second predetermined deviation rate. The second data traffic has an identification error. When the processing unit 1004 determines that the second data traffic associated with the protocol type to be monitored has an identification error, the processing unit 1004 is further configured to trigger an identification error protection action.
  • the processing unit 1004 is further configured to determine The second data traffic associated with the protocol type to be monitored does not have an identification error.
  • the processing unit 1004 determines that the second data traffic associated with the protocol type to be monitored does not have an identification error, the processing unit 1004 is further configured to update the second threshold to the second data traffic. The average value of the value of the flow information and the value of the flow information of the first data flow.
  • the traffic information of the first data traffic further includes a first user quantity, where the first user quantity is used to indicate the number of users associated with the first data traffic.
  • the absolute value of the deviation rate of the value of the flow rate information of the first data flow with respect to the first threshold is specifically: the absolute value of the deviation rate of the value of the first data amount relative to the first data amount threshold multiplied by the first And an absolute value of the deviation rate of the value of the first user amount relative to the first user amount threshold multiplied by a sum of the second weights, wherein the first threshold includes the first data amount threshold and the first A user amount threshold, the sum of the first weight and the second weight being 1.
  • the traffic information of the first data traffic further includes a first user quantity, where the first user quantity is used to indicate the number of users associated with the first data traffic.
  • the traffic information of the second data traffic further includes a second user amount, where the second user amount is used to indicate the number of users associated with the second data traffic.
  • the absolute value of the deviation rate of the value of the flow rate information of the second data flow with respect to the second threshold is specifically: the absolute value of the deviation rate of the value of the second data amount relative to the second data amount threshold multiplied by the first And a weight of the second user amount threshold value and the second user amount threshold value a second user quantity threshold, the second data quantity threshold is a value of a first data quantity of the first data flow, and the second user quantity threshold is a value of a first user quantity of the first data flow, The sum of the first weight and the second weight is 1.
  • the traffic information of the first data traffic further includes a first user quantity, where the first user quantity is used to indicate the number of users associated with the first data traffic.
  • the traffic information of the second data traffic further includes a second user amount, where the second user amount is used to indicate the number of users associated with the second data traffic.
  • the absolute value of the deviation rate of the value of the flow rate information of the second data flow with respect to the second threshold is specifically: the absolute value of the deviation rate of the value of the second data amount relative to the second data amount threshold multiplied by the first And a weight of the second user amount threshold value and the second user amount threshold value a second user quantity threshold, the second data quantity threshold is a value of a first data quantity of the first data flow, and the second user quantity threshold is a value of a first user quantity of the first data flow, The sum of the first weight and the second weight is 1.
  • the processing unit 1004 is configured to update the second threshold to an average value of the value of the traffic information of the second data traffic and the value of the traffic information of the first data traffic, specifically for:
  • the second data amount threshold is updated to an average of the value of the second data amount of the second data flow and the value of the first data amount of the first data flow, and the processing unit 1004 is further configured to Updating the second user amount threshold to a value of the second user amount of the second data traffic and a first user of the first data traffic The average of the values of the quantities.
  • the monitoring device shown in Fig. 3 can perform the corresponding steps performed by the monitoring device in the method of the above embodiment. Therefore, the monitoring device monitors the data traffic associated with the protocol type to be monitored, and triggers the corresponding identification error protection action, which helps reduce the loss of the communication operator's interests and improves the user's online experience.
  • FIG. 4 is a schematic structural diagram of hardware of a monitoring apparatus 1100 according to an embodiment of the present application.
  • the monitoring device 1100 shown in FIG. 4 can perform the corresponding steps performed by the monitoring device in the method of the above embodiment.
  • the monitoring device 1100 includes a processor 1101, a memory 1102, an interface 1103, and a bus 1104.
  • the interface 1103 can be implemented by using a wireless or wired manner, and specifically can be a network card.
  • the above processor 1101, memory 1102, and interface 1103 are connected by a bus 1104.
  • the interface 1103 may specifically include a transmitter and a receiver, where the monitoring device receives data traffic from the user equipment or the IP network, or receives traffic information of the data traffic from the SA device, and is also configured to send an identification error protection action. .
  • the interface 1103 is configured to support receiving data traffic from a user equipment or an IP network in FIG. 2 and transmitting an identification error protection action triggered by the processor 1101.
  • the processor 1101 is configured to perform processing performed by the monitoring device in the above embodiment.
  • the processor 1101 is configured to acquire traffic information of the first data traffic, where the traffic information of the first data traffic includes a first data volume, where the first data volume is used to indicate the first data traffic.
  • the processor 1101 is further configured to trigger an identification error protection action when the first data traffic associated with the protocol type to be monitored has an identification error; and/or other processes for the techniques described herein.
  • the processor 1101 is configured to support the processes S104, S106, and S108 of FIG.
  • the memory 1102 includes an operating system 11021 and an application 11022 for storing programs, codes, or instructions that can be executed when the processor or hardware device executes the programs, code, or instructions.
  • the memory 1102 can include a read-only memory (English: Read-only Memory, abbreviated as ROM) and a random access memory (English: Random Access Memory, abbreviation: RAM).
  • the ROM includes a basic input/output system (English: Basic Input/Output System, BIOS) or an embedded system;
  • the RAM includes an application and an operating system.
  • BIOS Basic Input/Output System
  • the booting device 1100 is booted into a normal operating state by booting the BIOS in the ROM or the bootloader booting system in the embedded system.
  • the application program and the operating system running in the RAM are executed, thereby completing the processing procedure involving the monitoring device in the method embodiment.
  • FIG. 4 only shows a simplified design of the monitoring device.
  • the monitoring device can include any number of interfaces, processors or memories.
  • all functions of the monitoring device are integrated in the SA device.
  • part of the functionality of the monitoring device is integrated in the SA device.
  • the monitoring device is implemented by a hardware device that is independent of the SA device.
  • the embodiment of the present application provides a computer storage medium for storing computer software instructions used by the monitoring device, which includes a program designed to execute the foregoing method embodiments.
  • the embodiment of the present application further includes a system for monitoring data traffic, the system including a monitoring device, and the monitoring device is the monitoring device in FIG. 3 or FIG. 4 described above.
  • the steps of a method or algorithm described in connection with the present disclosure may be implemented in a hardware or may be implemented by a processor executing software instructions.
  • the software instructions may be composed of corresponding software modules, which may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, A hard disk, a removable hard disk, a CD-ROM, or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC. Additionally, the ASIC can be located in the user equipment.
  • the processor and the storage medium may also reside as discrete components in the user equipment.
  • the functions described herein can be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

Abstract

一种用于监测数据流量的方法、装置及系统。所述方法包括，监测装置根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量。所述监测装置获取所述第一数据流量的流量信息，并且，根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误。当所述监测装置确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述监测装置触发识别错误保护动作。从而，监测装置对待监测的协议类型关联的数据流量进行识别错误的监测，并且触发相应的识别错误保护动作，有助于减少通信运营商的利益损失和提高用户的上网体验。

Description

一种监测数据流量的方法、装置及系统
本申请要求于2017年05月23日提交中国专利局、申请号为201710370615.7、发明名称为“一种监测数据流量的方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种监测数据流量的方法、装置及系统。更具体的，本申请涉及对待监测的协议类型关联的数据流量的错误识别的检测和处理。
背景技术
近年来，随着互联网协议(英文：Internet Protocol，缩写：IP)网络的不断普及，IP网络的数据业务随着各种应用的发育成熟迎来了爆发式的发展。用户设备通过通信运营商提供的无线接入设备或有线接入设备访问位于IP网络另一侧的服务器，以便获得相应的服务。在传统的Web浏览和下载业务基础上，点到点(英文：Point-to-Point，缩写：P2P)业务、网络游戏和网络电话等应用的广泛普及为通信运营商带来了大量用户，同时也带来了更大的挑战。例如，基于P2P业务的应用往往对网络资源进行“贪婪的”侵占，占用了大量的互联网流量，导致网络不同程度的拥塞，从而大大降低了其他应用的用户体验。
在设备中引入业务感知(英文：Service Awareness，缩写：SA)技术可以解决这个问题。SA是一种通过对IP报文进行分析的方式判断出IP报文所属的协议类型和应用的技术。通过在用户和IP网络之间部署SA设备，实现对业务安全、内容计费和业务控制的功能。
在应用场景中，SA设备对数据流量提供了精确的识别能力和深入的信息提取能力。但是，由于应用软件的版本更新和异常流量等原因，导致SA设备对协议类型关联的数据流量出现识别错误，从而导致数据流量管控行为的失效或数据流量计费错误，对通信运营商的利益造成损失，降低了用户的上网体验。
发明内容
有鉴于此，本申请实施例提供了一种监测数据流量的方法、装置及系统，应用在用户设备通过通信运营商提供的设备访问IP网络的应用场景中。监测装置对待监测的协议类型关联的数据流量进行识别错误的监测，并且触发相应的识别错误保护动作，有助于减少通信运营商的利益损失和提高用户的上网体验。
本申请实施例提供的技术方案如下。
第一方面，提供了一种监测数据流量的方法。其中，监测装置根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量，所述待监测的协议类型用于指示数据流量关联的应用。然后，所述监测装置获取所述第一数据流量的流量信息，所述第一数据流量的流量信息包括第一数据量，所述第一数据量用于指示所述第一数据流量中所有报文的长度的总和。所述监测装置根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误。并且，当所述监测装置确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述监测装置触发识别错误保护动作。可选的，所述第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量。
基于实施例提供的方案，所述监测装置根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误。当所述监测装置确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述监测装置触发识别错误保护动作。从而，监测装置对待监测的协议类型关联的数据流量进行识别错误的监测，并且触发相应的识别错误保护动作，有助于减少通信运营商的利益损失和提高用户的上网体验。
在第一方面的一种可能的实现方式中，所述监测装置根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误，包括：所述监测装置根据所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值大于第一预定偏差率，确定所述待监测的协议类型关联的所述第一数据流量存在识别错误，所述第一阈值为预设值。
在第一方面的再一种可能的实现方式中，所述监测装置根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量，包括：所述监测装置根据待监测的协议类型采集第一预定时刻对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到所述第一数据流量。所述方法还包括，所述监测装置根据所述待监测的协议类型采集第二预定时刻对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第二数据流量，所述第一预定时刻和所述第二预定时刻为不同日期的相同时刻。所述监测装置获取所述第二数据流量的流量信息，所述第二数据流量的流量信息包括第二数据量，所述第二数据量用于指示所述第二数据流量中所有报文的长度的总和。所述监测装置根据所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，确定所述待监测的协议类型关联的所述第二数据流量是否存在识别错误，所述第二阈值为所述第一数据流量的流量信息的值。当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率时，所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误。当所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，所述监测装置触发识别错误保护动作。
在第一方面的又一种可能的实现方式中，所述监测装置根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量，包括：所述监测装置根据待监测的协议类型采集第一预定时间间隔对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到所述第一数据流量。所述方法还包括，所述监测装置根据所述待监测的协议类型采集第二预定时间间隔对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第二数据流量，所述第一预定时间间隔的开始时刻和所述第二预定时间间隔的开始时刻为不同日期的相同时刻，所述第一预定时间间隔的结束时刻和所述第二预定时间间隔的结束时刻为不同日期的相同时刻。所述监测装置获取所述第二数据流量的流量信息，所述第二数据流量的流量信息包括第二数据量，所述第二数据量用于指示所述第二数据流量中所有报文的长度的总和。所述监测装置根据所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，确定所述待监测的协议类型关联的所述第二数据流量是否存在识别错误，所述第二阈 值为所述第一数据流量的流量信息的值。当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率时，所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误。当所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，所述监测装置触发识别错误保护动作。
在第一方面的又一种可能的实现方式中，所述方法还包括，当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值小于或等于所述第二预定偏差率时，所述监测装置确定所述待监测的协议类型关联的所述第二数据流量不存在识别错误。当所述监测装置确定所述待监测的协议类型关联的所述第二数据流量不存在识别错误时，所述监测装置将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值。
可选的，所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值具体为：所述第一数据量的值相对于第一数据量阈值的偏差率的绝对值乘以第一权重与所述第一用户量的值相对于第一用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第一阈值包括所述第一数据量阈值和所述第一用户量阈值，所述第一权重与所述第二权重的和为1。
可选的，所述第二数据流量的流量信息还包括第二用户量，所述第二用户量用于指示所述第二数据流量关联的用户数量。所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值具体为：所述第二数据量的值相对于第二数据量阈值的偏差率的绝对值乘以第一权重与所述第二用户量的值相对于第二用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第二阈值包括所述第二数据量阈值和所述第二用户量阈值，所述第二数据量阈值为所述第一数据流量的第一数据量的值，所述第二用户量阈值为所述第一数据流量的第一用户量的值，所述第一权重与所述第二权重的和为1。
可选的，所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值具体为：所述第二数据量的值相对于第二数据量阈值的偏差率的绝对值乘以第一权重与所述第二用户量的值相对于第二用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第二阈值包括所述第二数据量阈值和所述第二用户量阈值，所述第二数据量阈值为所述第一数据流量的第一数据量的值，所述第二用户量阈值为所述第一数据流量的第一用户量的值，所述第一权重与所述第二权重的和为1。所述监测装置将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值具体为：所述监测装置将所述第二数据量阈值更新为所述第二数据流量的第二数据量的值和所述第一数据流量的第一数据量的值的平均值，以及，所述监测装置将所述第二用户量阈值更新为所述第二数据流量的第二用户量的值和所述第一数据流量的第一用户量的值的平均值。
可选的，所述识别错误保护动作包括以下动作中的至少一个：告警，流量放行，流量限流和流量阻断。
第二方面，提供了一种监测数据流量的监测装置，所述监测装置具有实现上述方法中监测装置行为的功能。所述功能可以基于硬件实现，也可以基于硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一个可能的设计中，监测装置的结构中包括处理器和接口，所述处理器被配置为支持监测装置执行上述方法中相应的功能。所述接口用于支持监测装置与用户设备及IP网络进行通信，向用户设备及IP网络发送上述方法中所涉及的信息或者指令，或者从用户设备及IP网络接收上述方法中所涉及的信息或者指令。所述监测装置还可以包括存储器，所述存储器用于与处理器耦合，其保存监测装置必要的程序指令和数据。
在另一个可能的设计中，所述监测装置包括：处理器、发送器、随机存取存储器、只读存储器以及总线。其中，处理器通过总线分别耦接发送器、随机存取存储器以及只读存储器。其中，当需要运行监测装置时，通过固化在只读存储器中的基本输入/输出系统或者嵌入式系统中的bootloader引导系统进行启动，引导监测装置进入正常运行状态。在监测装置进入正常运行状态后，在随机存取存储器中运行应用程序和操作系统，使得该处理器执行第一方面或第一方面的任意可能的实现方式中的方法。
第三方面，提供一种监测数据流量的系统，所述系统包括监测装置，所述监测装置为前述第二方面中的监测装置。
第四方面，提供了一种计算机存储介质，用于储存为上述监测装置所用的程序、代码或指令，当处理器或硬件设备执行这些程序、代码或指令时可以完成上述方面中监测装置的功能或步骤。
通过上述方案，本申请实施例提供的用于监测数据流量的方法、装置及系统，监测装置根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量。所述监测装置获取所述第一数据流量的流量信息，所述第一数据流量的流量信息包括第一数据量，所述第一数据量用于指示所述第一数据流量中所有报文的长度的总和。所述监测装置根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误。当所述监测装置确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述监测装置触发识别错误保护动作。从而，监测装置对待监测的协议类型关联的数据流量进行识别错误的监测，并且触发相应的识别错误保护动作，有助于减少通信运营商的利益损失和提高用户的上网体验。
附图说明
图1为本申请实施例的一种网络结构示意图；
图2为本申请实施例的一种监测数据流量的方法流程图；
图3为本申请实施例的监测装置的结构示意图；
图4为本申请实施例的监测装置的硬件结构示意图。
具体实施方式
本申请实施例提供了一种监测数据流量的方法、装置及系统，应用在用户设备通过通信运营商提供的设备访问IP网络的应用场景中。监测装置对待监测的协议类型关联的数据流量进行识别错误的监测，并且触发相应的识别错误保护动作，有助于减少通信运营商的利益损失和提高用户的上网体验。
下面通过具体实施例，分别进行详细的说明。
图1为本申请实施例的一种网络结构示意图。在图1所示的网络中，用户可以使用用户设备经由IP网络访问位于所述IP网络另一侧的网络资源。其中，网络资源可以提供Web浏览、数据下载和数据上传等服务。用户也可以使用用户设备经由IP网络与位于所述IP网络 另一侧用户进行视频、语音和即时消息的通信。具体的，用户设备可以通过无线网络或有线宽带网络与IP网络进行通信。在用户设备通过无线网络与IP网络进行通信的场景中，所述网络结构还包括基站和网关GPRS支撑节点(英文：Gateway GPRS Support Node，缩写：GGSN)，其中GPRS是通用分组无线业务(英文：General Packet Radio Service)。用户设备可以经由基站和GGSN与IP网络进行通信。在用户设备通过有线宽带网络与IP网络进行通信的场景中，所述网络结构还包括宽带接入服务器(英文：Broadband Access Server，缩写：BAS)。用户设备可以经由BAS与IP网络进行通信。其中，所述GGSN和BAS可以是路由器。所述用户设备可以是以下设备中的至少一种：智能手机、个人数字助理(英文：Personal Digital Assistant，缩写：PDA)、基于IP的语音传输(英文：Voice over Internet Protocol，缩写：VoIP)的网络设备、便携计算机和台式计算机等。
如图1所示，所述网络结构还包括流量分析管理系统。所述流量分析管理系统被部署在GGSN与IP网络之间的通信链路上，或者，所述流量分析管理系统被部署在BAS与IP网络之间的通信链路上，或者，GGSN和BAS设备经由同一个流量分析管理系统与IP网络进行通信。所述流量分析管理系统实现从用户设备到IP网络的数据流量或从IP网络到用户设备的数据流量的分析，并且，根据分析的结果实现从用户设备到IP网络的数据流量或从IP网络到用户设备的数据流量的管理。所述流量分析管理系统可以包括SA设备和监测装置。
在应用场景中，SA设备对数据流量提供了精确的识别能力和深入的信息提取能力。所述SA设备获取数据流量中的协议类型，并且将获取的数据流量中的协议类型与所述SA设备保存的协议类型进行比较，从而识别出获取的数据流量中的协议类型属于哪种协议类型。但是，由于应用软件的版本更新和异常流量等原因，可能导致SA设备对协议类型关联的数据流量出现识别错误。例如，应用软件的版本已经更新，但SA设备中保存的协议类型的特征没有及时更新，SA设备在识别更新版本后的应用软件发送数据流量时，导致SA设备将数据流量识别为未知协议类型或识别为另一个协议类型。又例如，用户设备发送的数据流量为异常流量，导致SA设备将数据流量识别为未知协议类型或识别为另一个协议类型。这样的识别错误将导致数据流量管控行为的失效或数据流量计费错误。
本申请实施例提供的监测装置能够实现对上述识别错误的监测，并根据存在上述识别错误的情况触发识别错误保护动作。其中，所述监测装置根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量。所述监测装置获取所述第一数据流量的流量信息，所述第一数据流量的流量信息包括第一数据量，所述第一数据量用于指示所述第一数据流量中所有报文的长度的总和。所述监测装置根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误。当所述监测装置确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述监测装置触发识别错误保护动作。在一种可能的实现方式中，所述监测装置的全部功能被集成在所述SA设备中。在另一种可能的实现方式中，所述监测装置的部分功能被集成在所述SA设备中，即，所述监测装置实现的以下功能被集成在所述SA设备中实现：根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量；所述监测装置获取所述第一数据流量的流量信息，所述第一数据流量的流量信息包括第一数据量，所述第一数据量用于指示所述第一数据流量中所有报文的长度的总和。在又一种可能的实现方式中，所述监测装 置由独立于所述SA设备的硬件装置实现。所述监测装置具体的实现方式和部署方式可以参见本申请实施例的后续解释和说明。
应当理解，图1所示的网络结构示例性的展示了本申请的监测装置的应用场景。所述监测装置可以应用在各种需要对数据流量进行分析和管理的应用场景中。例如，所述监测装置应用在企业内部局域网中，以便实现对企业内部数据流量的分析和管理。又例如，所述监测装置应用在运营商之间的数据流量交换的场景中，以便实现运营商之间交互流量的分析和管理。
通过上述实施方式，监测装置根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量。所述监测装置获取所述第一数据流量的流量信息，并且，所述监测装置根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误。当所述监测装置确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述监测装置触发识别错误保护动作。从而，监测装置对待监测的协议类型关联的数据流量进行识别错误的监测，并且触发相应的识别错误保护动作，有助于减少通信运营商的利益损失和提高用户的上网体验。
图2为本申请实施例的一种监测数据流量的方法流程图。图2所示的方法可以应用于图1所示的网络结构中。如图2所示，所述方法包括：
S102，监测装置根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量。
根据图1，所述用户设备可以向所述IP网络发送数据流量，所述用户设备也可以接收来自所述IP网络的数据流量。在本实施例中以所述用户设备向所述IP网络发送数据流量为例进行说明。
所述监测装置接收来自所述用户设备的数据流量，所述用户设备可以为一台或多台。其中，一个用户可以对应一台用户设备，或者一个用户可以对应多台用户设备，例如，两台用户设备共用一个用户帐号与所述IP网络进行通信。所述监测装置可以包括特征库，所述特征库保存有待监测的协议类型和相应的识别特征，其中所述识别特性包括应用软件使用的协议类型的识别特征。所述待监测的协议类型是指需要使用监测装置进行监测的协议类型。下面表1示出了常用的17个大类协议类型。可选的，每个大类协议类型还可以包括若干个小类协议类型，以便监测装置能够以更细粒度的小类协议类型进行监测。例如，根据业务需求，需要采集P2P协议和Video协议关联的数据流量，即待监测的协议类型为P2P协议和Video协议。所述监测装置根据P2P协议和Video协议采集来自用户设备的数据流量中所述P2P协议关联的数据流量和所述Video协议关联的数据流量。具体的，所述监测装置分析来自用户设备的数据流量的识别特征，并且与所述特征库中的识别特征进行比较，从而确定对应的协议类型，将来自用户设备的数据流量中属于该协议类型的流量数据采集出来。由于所述特征库保存有与待监测的协议类型对应的应用软件的协议类型的识别特征，因此，所述待监测的协议类型用于指示数据流量关联的应用。
Figure PCTCN2017111606-appb-000001
Figure PCTCN2017111606-appb-000002
表1
对于所述监测装置的特征库，可以通过静态配置的方式设置所述特征库中保存的待监测的协议类型和相应的识别特征，也可以由监测设备向所述SA设备请求下发所述特征库中保存的待监测的协议类型和相应的识别特征。另外，在所述监测装置的全部功能被集成在所述SA设备中的场景和所述监测装置的部分功能被集成在所述SA设备中的场景，S102步骤可以由SA设备实现，监测装置可以直接调用所述SA设备的特征库。
所述监测装置通过采集手段获得第一数据流量过程中，可以对某个时刻的数据流量进行采集，以便获得第一数据流量，例如，对10:00AM(AM表示上午)的数据流量进行采集；也可以对某个时间间隔的数据流量进行采集，以便获得第一数据流量，例如，对10:00AM-10:05AM的数据流量进行采集。所述监测装置还可以对数据流量进行周期性采集，例如，对2016年3月1日的10:00AM的数据流量进行采集，对2016年3月2日的10:00AM的数据流量进行采集，对2016年3月3日的10:00AM的数据流量进行采集等。
S104，所述监测装置获取所述第一数据流量的流量信息，所述第一数据流量的流量信息包括第一数据量。
根据上述S102，所述监测装置通过采集过程获得所述第一数据流量，所述第一数据流量是来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量。例如，来自用户设备的数据流量包括P2P数据流量，VOIP数据流量和Video数据流量，并且，待监测的协议类型为Video协议，因此，所述监测装置通过采集过程获得的第一数据流量包括Video数据流量。
所述监测装置获取所述第一数据流量的流量信息。所述第一数据流量的流量信息包括第一数据量，所述第一数据量用于指示所述第一数据流量中所有报文的长度的总和。所述 第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量。对于用户设备发出的数据流量，所述监测装置可以统计所述第一数据流量关联的源IP地址数量确定所述第一用户量。对于用户设备接收来自IP网络的数据流量，所述监测装置可以统计所述第一数据流量关联的目的IP地址数量确定所述第一用户量。在上述两个方向的数据流量中，所述监测装置还可以统计所述第一数据流量关联的用户帐户数量确定所述第一用户量。在上述两个方向的数据流量中，所述监测装置还可以通过五元组信息的部分信息或全部信息确定所述第一用户量，所述五元组信息包括源IP地址、目的IP地址、源端口号、目的端口号和协议号。例如，所述监测装置可以统计所述第一数据流量关联的源IP地址和目的IP地址形成的信息组的数量确定所述第一用户量，其中，一对源IP地址和目的IP地址确定一个连接。又例如，所述监测装置可以统计所述第一数据流量关联的源IP地址、目的IP地址源端口号和目的端口号形成的信息组的数量确定所述第一用户量。再例如，所述监测装置可以统计所述第一数据流量关联的五元组的数量确定所述第一用户量。
S106，所述监测装置根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误。
所述监测装置可以根据所述第一数据流量的第一数据量确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误。所述监测装置还可以根据所述第一数据流量的第一数据量和第一用户量确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误。其中，以流量信息包括第一数据量为例说明识别错误。在一种可能的实现方式中，所述识别错误是指本协议类型关联的数据流量中的部分数据流量被识别到其他的协议类型关联的数据流量中。例如，在对P2P数据流量进行监测的实现方式中，应该被识别出的P2P数据流量为1Gb(Gb：gigabit)。但由于应用软件的版本更新或异常流量等原因，导致1Gb的P2P数据流量中的0.2Gb被识别为Video数据流量。由此这样，P2P数据流量中的部分数据流量被识别为Video数据流量，实际识别出的P2P数据流量为0.8Gb。在另一种可能的实现方式中，所述识别错误是指本协议类型关联的数据流量中包括了其他的协议类型关联的数据流量。例如，在对P2P数据流量进行监测的实现方式中，应该被识别出的P2P数据流量为1Gb。但由于应用软件的版本更新或异常流量等原因，导致0.5Gb的Video数据流量被识别为P2P数据流量。由此这样，P2P数据流量中包括了被识别为P2P数据流量的Video数据流量，实际识别出的P2P数据流量为1.5Gb。类似的，当流量信息包括第一数据量和第一用户量时，可以使用上述数据量的监测方法监测第一用户量的变化情况，并根据第一数据量和第一用户量，以及第一数据量的权重和第一用户量的权重最终确定是否存在识别错误。如此这样，所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值具体为：所述第一数据量的值相对于第一数据量阈值的偏差率的绝对值乘以第一权重与所述第一用户量的值相对于第一用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第一阈值包括所述第一数据量阈值和所述第一用户量阈值，所述第一权重与所述第二权重的和为1。在S106中，通过监测流量信息中的数据量的变化或者通过监测流量信息中的数据量和用户量的变化，确定待监测的协议类型关联的数据流量是否存在识别错误。
在S106中，可选的，所述监测装置根据所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值大于第一预定偏差率，确定所述待监测的协议类型关联的 所述第一数据流量存在识别错误，所述第一阈值为预设值。
以流量信息包括第一数据量为例说明。假设监测装置监测到2016年3月1日10:00AM用户设备发送的第一数据流量的第一数据量为5Gb，所述第一数据流量为P2P数据流量。基于历史经验，设定每天10:00AM时，P2P数据流量的数据量阈值为4Gb，因此第一阈值被设定为4Gb。第一预定偏差率被设定为20％。所述第一数据流量的流量信息的值相对于第一阈值的偏差率为：(第一数据流量-第一阈值)/第一阈值*100％，即(5Gb-4Gb)/4Gb*100％＝25％。取绝对值后的偏差率大于第一预定偏差率(25％>20％)，因此，确定所述待监测的协议类型关联的所述第一数据流量存在识别错误。相应的，如果计算的偏差率小于或等于第一预定偏差率，则可以确定所述待监测的协议类型关联的所述第一数据流量不存在识别错误。
以流量信息包括第一数据量和第一用户量为例说明。假设监测装置监测到2016年3月1日10:00AM用户设备发送的第一数据流量的第一数据量为5Gb，第一用户量为1100，所述第一数据流量为P2P数据流量。基于历史经验，设定每天10:00AM时，P2P数据流量的数据量阈值为4Gb，用户量阈值为1000，因此第一数据量阈值被设定为4Gb，第一用户量阈值被设定为1000，其中第一阈值包括第一数据量阈值和第一用户量阈值。第一预定偏差率被设定为20％。计算第一数据量和第一用户量的偏差率：(第一数据量-第一数据量阈值)/第一数据量阈值*100％，即(5Gb-4Gb)/4Gb*100％＝25％；(第一用户量-第一用户量阈值)/第一用户量阈值*100％，即(1100-1000)/1000*100％＝10％。对上述偏差率分别取绝对值，所述第一数据流量的流量信息的值相对于第一阈值的偏差率为：25％*0.8+10％*0.2＝22％。其中，第一数据量的权重为0.8，第一用户量的权重为0.2。计算后的偏差率大于第一预定偏差率(22％>20％)，因此，确定所述待监测的协议类型关联的所述第一数据流量存在识别错误。
其中，监测装置可以周期性的监测所述第一数据流量，以便确定每个周期内的第一数据流量是否存在识别错误。例如，监测装置监测每天10:00AM时的第一数据流量的流量信息。通过将每天计算得到的偏差率的绝对值和第一预定偏差率进行比较，确定每天的第一数据流量是否存在识别错误。又例如，监测装置监测每天10:00AM-10:05AM对应的第一数据流量的流量信息。
S108，当所述监测装置确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述监测装置触发识别错误保护动作。
识别错误保护动作包括以下动作中的至少一个：告警，流量放行，流量限流和流量阻断。所述监测装置触发识别错误保护动作包括：所述监测装置生成告警信息，并且向管理设备发送所述告警信息，以便网络管理员及时发现协议类型关联的所述第一数据流量存在的识别错误；所述监测装置生成流量放行命令，流量限流命令或流量阻断命令，并且向SA设备发送所述流量放行命令，所述流量限流命令或所述流量阻断命令，以便所述SA设备执行流量放行，流量限流或流量阻断。可选的，告警信息包括出现识别错误的数据流量的协议类型。进一步可选的，告警信息还包括数据流量的流量信息或者数据流量的流量信息的值相对于阈值的偏差率。当告警信息包括上述偏差率时，所述告警信息还包括偏差率的正负标志。可选的，所述流量放行命令，所述流量限流命令和所述流量阻断命令均包括出现识别错误的数据流量的协议类型。
举例说明，在S106中确定所述第一数据流量的流量信息的值相对于第一阈值的偏 差率的绝对值为25％，大于第一预定偏差率20％。所述监测装置生成告警信息，并且向管理设备发送所述告警信息。
举例说明，假设第一数据流量为视频网站A的定向视频，运营商需要对该定向视频进行计费，并且假设每天10:00AM时，该定向视频的第一阈值为4Gb。经过监测装置的监测发现2016年3月1日10:00AM时，第一数据流量的第一数据量为1Gb。计算后，确定所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值为75％，大于第一预定偏差率20％。所述监测装置生成告警信息，并且向管理设备发送所述告警信息，以便通知管理设备该识别错误可能造成计费错误。可选的，所述监测装置向SA设备发送流量阻断命令，通知SA设备对所述定向视频进行流量阻断。
举例说明，假设第一数据流量为VOIP数据流量，SA设备对VOIP数据流量的限流值为2Gb。经过监测装置的监测发现2016年3月1日10:00AM时，第一数据流量的第一数据量为5Gb。类似上述示例的监测手段，监测装置确定第一数据流量存在识别错误。第一数据流量突然增大的原因可能是因为非VOIP数据流量被识别为VOIP数据流量。此时，如果SA设备依然按照限流值为2Gb的手段对VOIP数据流量进行限流，那么可能导致真实的VOIP数据流量损失流量。因此，监测装置向管理设备进行告警，并且，监测装置还向SA设备发送流量放行命令，通知SA设备对5Gb的第一数据流量进行流量放行。从而，避免因SA设备的限流规则导致的业务流量受损，进而避免影响用户的上网体验。管理设备在收到告警，并排除故障后，SA设备将恢复原有的限流规则。
上述实施方式可以应用在所述监测装置的全部功能被集成在所述SA设备中的场景，上述S102-S108在所述SA设备实现，具体的，可以通过改造SA设备的方式，使得SA设备具备本申请监测装置的功能。上述实施方式也可以应用在所述监测装置的部分功能被集成在所述SA设备中的场景，例如，所述监测装置包括监测模块，识别错误分析模块和识别错误保护模块。所述监测模块被集成在所述SA设备中，以便实现上述S102和S104。实现上述S106的所述识别错误分析模块和实现上述S108的所述识别错误保护模块由独立于所述SA设备的硬件完成。所述SA设备与所述硬件之间通过通信链路连接。上述实施方式还可以应用在独立于所述SA设备的硬件装置场景中，所述硬件装置完成上述S102-S108。
通过上述实施方式，监测装置根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量。所述监测装置获取所述第一数据流量的流量信息，并且，所述监测装置根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误。当所述监测装置确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述监测装置触发识别错误保护动作。从而，监测装置对待监测的协议类型关联的数据流量进行识别错误的监测，并且触发相应的识别错误保护动作，有助于减少通信运营商的利益损失和提高用户的上网体验。
可选的，S102包括所述监测装置根据待监测的协议类型采集第一预定时刻对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到所述第一数据流量。所述监测数据流量的方法还包括：所述监测装置根据所述待监测的协议类型采集第二预定时刻对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第二数据流量，所述第一预定时刻和所述第二预定时刻为不同日期的相同时刻；所述监测装置获取所述第二数据流量的流 量信息，所述第二数据流量的流量信息包括第二数据量，所述第二数据量用于指示所述第二数据流量中所有报文的长度的总和；所述监测装置根据所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，确定所述待监测的协议类型关联的所述第二数据流量是否存在识别错误，所述第二阈值为所述第一数据流量的流量信息的值；当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率时，所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误；当所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，所述监测装置触发识别错误保护动作。
结合本申请实施例前述的解释说明，监测装置可以针对某个预定时刻的数据流量进行采集，并且周期性的对每天或者每周或者每月的相同时刻的数据流量进行采集，例如，第一预定时刻为2016年3月1日10:00AM，第二预定时刻为2016年3月2日10:00AM。又例如，第一预定时刻为第一周的周一的10:00AM，第二预定时刻为第二周的周一的10:00AM。
监测装置可以按照前述S102-S108的实现方式完成对应所述第一预定时刻的第一数据流量的监测。如果所述监测装置确定所述待监测的协议类型关联的所述第一数据流量不存在识别错误，所述监测装置将所述第一数据流量的流量信息的值确定为第二阈值，以便监测装置根据所述第二阈值对第二预定时刻的第二流量数据进行监测。其中，当所述第一数据流量的流量信息包括第一数据量时，将第一数据量确定为所述第二阈值。当所述第一数据流量的流量信息包括第一数据量和第一用户量时，将第一数据量确定为第二数据量阈值和将第一用户量确定为第二用户量阈值，所述第二阈值包括第二数据量阈值和第二用户量阈值。
所述监测装置可以按照S102和S104的实现方式，获取第二预定时刻的第二数据流量以及所述第二数据流量的流量信息。进一步，所述监测装置可以按照S106的实现方式确定所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，从而，确定所述待监测的协议类型关联的所述第二数据流量是否存在识别错误。如果所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率，所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误。根据前述，第二阈值为所述第一数据流量的流量信息的值。所述第二预定偏差率可以和所述第一预定偏差率相同，也可以不同。当所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，按照S108的实现方式，所述监测装置触发识别错误保护动作。
进一步可选的，当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值小于或等于所述第二预定偏差率时，所述监测装置确定所述待监测的协议类型关联的所述第二数据流量不存在识别错误；当所述监测装置确定所述待监测的协议类型关联的所述第二数据流量不存在识别错误时，所述监测装置将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值。
举例说明，假设待监测的协议类型为P2P协议，流量信息包括数据量。经过上述S102-S108的实现方式，第一数据流量的第一数据量为4.5Gb，第一预定时刻为2016年3月1日10:00AM。基于历史经验，设定第一阈值为4Gb。第一预定偏差率和第二预定偏差率均被设定为20％。所述第一数据流量的流量信息的值相对于第一阈值的偏差率为： (4.5Gb-4Gb)/4Gb*100％＝12.5％，取绝对值后的偏差率小于第一预定偏差率。因此，所述第一数据流量不存在识别错误。监测装置将第一数据量确定为第二阈值，即第二阈值为4.5Gb。监测装置针对P2P协议的待监测的协议类型，获取第二数据流量。经过监测装置的监测，所述第二数据流量的第二数据量为3.8Gb，第二预定时刻为2016年3月2日10:00AM。经过计算，所述第二数据流量的流量信息的值相对于第二阈值的偏差率为：(3.8Gb-4.5Gb)/4.5Gb*100％＝-15.6％，取绝对值后的偏差率小于第二预定偏差率。因此，所述第二数据流量不存在识别错误。所述监测装置将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值，即第二阈值更新为：(4.5Gb+3.8Gb)/2＝4.15Gb。监测装置使用4.15Gb作为新的第二阈值替换原有4.5Gb的第二阈值。进一步，监测装置可以根据数值为4.15Gb的第二阈值针对第三预定时刻的第三数据流量进行监测，其中，第三预定时刻2016年3月3日10:00AM。如果所述第三数据流量不存在识别错误，所述监测装置按照上述方法更新第二阈值。
可选的，所述第一数据流量的流量信息包括第一数据量和第一用户量，所述第二数据流量的流量信息包括第二数据量和第二用户量。所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值具体为：所述第二数据量的值相对于第二数据量阈值的偏差率的绝对值乘以第一权重与所述第二用户量的值相对于第二用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第二阈值包括所述第二数据量阈值和所述第二用户量阈值，所述第二数据量阈值为所述第一数据流量的第一数据量的值，所述第二用户量阈值为所述第一数据流量的第一用户量的值，所述第一权重与所述第二权重的和为1。
进一步可选的，所述监测装置将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值具体为：所述监测装置将所述第二数据量阈值更新为所述第二数据流量的第二数据量的值和所述第一数据流量的第一数据量的值的平均值，以及，所述监测装置将所述第二用户量阈值更新为所述第二数据流量的第二用户量的值和所述第一数据流量的第一用户量的值的平均值。
举例说明，假设待监测的协议类型为P2P协议，流量信息包括数据量和用户量。经过上述S102-S108的实现方式，第一数据流量的第一数据量为4.5Gb，第一数据流量的第一用户量为1100，第一预定时刻为2016年3月1日10:00AM。基于历史经验，设定第一数据量阈值为4Gb，第一用户量阈值为1000。第一预定偏差率和第二预定偏差率均被设定为20％。计算第一数据量和第一用户量的偏差率：(4.5Gb-4Gb)/4Gb*100％＝12.5％；(1100-1000)/1000*100％＝10％。对上述偏差率分别取绝对值，所述第一数据流量的流量信息的值相对于第一阈值的偏差率为：12.5％*0.8+10％*0.2＝12％，计算后的偏差率小于第一预定偏差率。因此，所述第一数据流量不存在识别错误。监测装置将第一数据量和第一用户量确定为第二阈值，即第二数据量阈值为4.5Gb，第二数据用户量阈值为1100。监测装置针对P2P协议的待监测的协议类型，获取第二数据流量。经过监测装置的监测，所述第二数据流量的第二数据量为3.8Gb，第二用户量为980，第二预定时刻为2016年3月2日10:00AM。经过计算，第一数据量和第一用户量的偏差率为：(3.8Gb-4.5Gb)/4.5Gb*100％＝-15.6％，(980-1100)/1100*100％＝-10.9％。对上述偏差率分别取绝对值，所述第二数据流量的流量信息的值相对于第二阈值的偏差率为：15.6％*0.8+10.9％*0.2＝14.7％，计算后的偏差率小于第二预定偏差率。因此，所述第二 数据流量不存在识别错误。所述监测装置将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值，即第二阈值更新为：(4.5Gb+3.8Gb)/2＝4.15Gb(第二数据量阈值)和(1100+980)/2＝1040(第二用户量阈值)。监测装置使用4.15Gb作为新的第二数据量阈值替换原有4.5Gb的第二数据量阈值，使用1040作为新的第二用户量阈值替换原有1100的第二用户量阈值。进一步，监测装置可以根据数值为4.15Gb的第二数据量阈值和数值为1040的第二用户量阈值针对第三预定时刻的第三数据流量进行监测，其中，第三预定时刻2016年3月3日10:00AM。如果所述第三数据流量不存在识别错误，所述监测装置按照上述方法更新第二阈值。
可选的，S102包括所述监测装置根据待监测的协议类型采集第一预定时间间隔对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到所述第一数据流量。所述监测数据流量的方法还包括：所述监测装置根据所述待监测的协议类型采集第二预定时间间隔对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第二数据流量，所述第一预定时间间隔的开始时刻和所述第二预定时间间隔的开始时刻为不同日期的相同时刻，所述第一预定时间间隔的结束时刻和所述第二预定时间间隔的结束时刻为不同日期的相同时刻；所述监测装置获取所述第二数据流量的流量信息，所述第二数据流量的流量信息包括第二数据量，所述第二数据量用于指示所述第二数据流量中所有报文的长度的总和；所述监测装置根据所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，确定所述待监测的协议类型关联的所述第二数据流量是否存在识别错误，所述第二阈值为所述第一数据流量的流量信息的值；当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率时，所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误；当所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，所述监测装置触发识别错误保护动作。
结合本申请实施例前述的解释说明，监测装置可以针对某个预定时间间隔的数据流量进行采集，并且周期性的对每天或者每周或者每月的相同时间间隔的数据流量进行采集，例如，第一预定时间间隔为2016年3月1日10:00AM-10:05AM，第二预定时刻为2016年3月2日10:00AM-10:05AM。又例如，第一预定时刻为第一周的周一的10:00AM-10:05AM，第二预定时刻为第二周的周一的10:00AM-10:05AM。本实施例的实现方式与前述实施例的实现方式不同之处在于：将采集预定时刻的数据流量替换为采集预定时间间隔的数据流量。监测装置监测待监测的协议类型的数据流量的具体实现方式参见前述实施例，此处不进行赘述。
图3为本申请实施例的监测装置1000的结构示意图。图3所示的监测装置1000可以执行上述实施例的方法中监测装置1000执行的相应步骤。如图3所示，所述监测装置1000包括采集单元1002和处理单元1004。
所述采集单元1002，用于根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量，所述待监测的协议类型用于指示数据流量关联的应用；
所述处理单元1004，用于获取所述第一数据流量的流量信息，所述第一数据流量的流量信息包括第一数据量，所述第一数据量用于指示所述第一数据流量中所有报文 的长度的总和；
所述处理单元1004还用于根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误；
当所述处理单元1004确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述处理单元1004还用于触发识别错误保护动作。
所述识别错误保护动作包括以下动作中的至少一个：告警，流量放行，流量限流和流量阻断。
可选的，所述处理单元1004还用于在根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误中，具体用于：根据所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值大于第一预定偏差率，确定所述待监测的协议类型关联的所述第一数据流量存在识别错误，所述第一阈值为预设值。
可选的，所述采集单元1002用于在根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量中，具体用于：根据待监测的协议类型采集第一预定时刻对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到所述第一数据流量。所述采集单元1002还用于根据所述待监测的协议类型采集第二预定时刻对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第二数据流量，所述第一预定时刻和所述第二预定时刻为不同日期的相同时刻。所述处理单元1004还用于获取所述第二数据流量的流量信息，所述第二数据流量的流量信息包括第二数据量，所述第二数据量用于指示所述第二数据流量中所有报文的长度的总和。所述处理单元1004还用于根据所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，确定所述待监测的协议类型关联的所述第二数据流量是否存在识别错误，所述第二阈值为所述第一数据流量的流量信息的值。当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率时，所述处理单元1004还用于确定所述待监测的协议类型关联的所述第二数据流量存在识别错误。当所述处理单元1004确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，所述处理单元1004还用于触发识别错误保护动作。
可选的，所述采集单元1002用于在根据待监测的协议类型采集来自用户设备或IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量中，具体用于：根据待监测的协议类型采集第一预定时间间隔对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到所述第一数据流量。所述采集单元1002还用于根据所述待监测的协议类型采集第二预定时间间隔对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第二数据流量，所述第一预定时间间隔的开始时刻和所述第二预定时间间隔的开始时刻为不同日期的相同时刻，所述第一预定时间间隔的结束时刻和所述第二预定时间间隔的结束时刻为不同日期的相同时刻。所述处理单元1004还用于获取所述第二数据流量的流量信息，所述第二数据流量的流量信息包括第二数据量，所述第二数据量用于指示所述第二数据流量中所有报文的长度的总和。所述处理单元1004还用于根据所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，确定所述 待监测的协议类型关联的所述第二数据流量是否存在识别错误，所述第二阈值为所述第一数据流量的流量信息的值。当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率时，所述处理单元1004还用于确定所述待监测的协议类型关联的所述第二数据流量存在识别错误。当所述处理单元1004确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，所述处理单元1004还用于触发识别错误保护动作。
可选的，当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值小于或等于所述第二预定偏差率时，所述处理单元1004还用于确定所述待监测的协议类型关联的所述第二数据流量不存在识别错误。当所述处理单元1004确定所述待监测的协议类型关联的所述第二数据流量不存在识别错误时，所述处理单元1004还用于将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值。
可选的，所述第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量。所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值具体为：所述第一数据量的值相对于第一数据量阈值的偏差率的绝对值乘以第一权重与所述第一用户量的值相对于第一用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第一阈值包括所述第一数据量阈值和所述第一用户量阈值，所述第一权重与所述第二权重的和为1。
可选的，所述第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量。所述第二数据流量的流量信息还包括第二用户量，所述第二用户量用于指示所述第二数据流量关联的用户数量。所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值具体为：所述第二数据量的值相对于第二数据量阈值的偏差率的绝对值乘以第一权重与所述第二用户量的值相对于第二用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第二阈值包括所述第二数据量阈值和所述第二用户量阈值，所述第二数据量阈值为所述第一数据流量的第一数据量的值，所述第二用户量阈值为所述第一数据流量的第一用户量的值，所述第一权重与所述第二权重的和为1。
可选的，所述第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量。所述第二数据流量的流量信息还包括第二用户量，所述第二用户量用于指示所述第二数据流量关联的用户数量。所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值具体为：所述第二数据量的值相对于第二数据量阈值的偏差率的绝对值乘以第一权重与所述第二用户量的值相对于第二用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第二阈值包括所述第二数据量阈值和所述第二用户量阈值，所述第二数据量阈值为所述第一数据流量的第一数据量的值，所述第二用户量阈值为所述第一数据流量的第一用户量的值，所述第一权重与所述第二权重的和为1。所述处理单元1004用于在将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值中，具体用于：将所述第二数据量阈值更新为所述第二数据流量的第二数据量的值和所述第一数据流量的第一数据量的值的平均值，以及，所述处理单元1004还用于将所述第二用户量阈值更新为所述第二数据流量的第二用户量的值和所述第一数据流量的第一用户 量的值的平均值。
图3所示的监测装置可以执行上述实施例的方法中监测装置执行的相应步骤。从而实现监测装置对待监测的协议类型关联的数据流量进行识别错误的监测，并且触发相应的识别错误保护动作，有助于减少通信运营商的利益损失和提高用户的上网体验。
图4为本申请实施例的监测装置1100的硬件结构示意图。图4所示的监测装置1100可以执行上述实施例的方法中监测装置执行的相应步骤。
如图4所示，所述监测装置1100包括处理器1101、存储器1102、接口1103和总线1104。其中接口1103可以通过无线或有线的方式实现，具体来讲可以是网卡。上述处理器1101、存储器1102和接口1103通过总线1104连接。
所述接口1103具体可以包括发送器和接收器，用于监测装置接收来自用户设备或IP网络的数据流量；或者用于接收来自SA设备的数据流量的流量信息；还用于发送识别错误保护动作。作为举例，所述接口1103用于支持图2中的接收来自用户设备或IP网络的数据流量和发送所述处理器1101触发的识别错误保护动作。所述处理器1101用于执行上述实施例中由监测装置进行的处理。例如，所述处理器1101用于获取所述第一数据流量的流量信息，所述第一数据流量的流量信息包括第一数据量，所述第一数据量用于指示所述第一数据流量中所有报文的长度的总和；还用于根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误；当所述处理器1101确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述处理器1101还用于触发识别错误保护动作；和/或用于本文所描述的技术的其他过程。作为举例，所述处理器1101用于支持图2中的过程S104、S106和S108。存储器1102包括操作系统11021和应用程序11022，用于存储程序、代码或指令，当处理器或硬件设备执行这些程序、代码或指令时可以完成方法实施例中涉及监测装置的处理过程。可选的，所述存储器1102可以包括只读存储器(英文：Read-only Memory，缩写：ROM)和随机存取存储器(英文：Random Access Memory，缩写：RAM)。其中，所述ROM包括基本输入/输出系统(英文：Basic Input/Output System，缩写：BIOS)或嵌入式系统；所述RAM包括应用程序和操作系统。当需要运行监测装置1100时，通过固化在ROM中的BIOS或者嵌入式系统中的bootloader引导系统进行启动，引导监测装置1100进入正常运行状态。在监测装置1100进入正常运行状态后，运行在RAM中的应用程序和操作系统，从而，完成方法实施例中涉及监测装置的处理过程。
可以理解的是，图4仅仅示出了监测装置的简化设计。在实际应用中，监测装置可以包含任意数量的接口，处理器或者存储器。在一种可能的实现方式中，所述监测装置的全部功能被集成在所述SA设备中。在另一种可能的实现方式中，所述监测装置的部分功能被集成在所述SA设备中。在又一种可能的实现方式中，所述监测装置由独立于所述SA设备的硬件装置实现。
另外，本申请实施例提供了一种计算机存储介质，用于储存为上述监测装置所用的计算机软件指令，其包含用于执行上述方法实施例所设计的程序。
如图1所示，本申请实施例还包括一种监测数据流量的系统，所述系统包括监测装置，所述监测装置为前述图3或图4中的监测装置。
结合本申请公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于RAM存储器、闪存、ROM存储器、EPROM存储器、EEPROM存储器、寄存器、 硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于用户设备中。当然，处理器和存储介质也可以作为分立组件存在于用户设备中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明。所应理解的是，以上所述仅为本申请的具体实施方式而已。

Claims (18)

  1. 一种监测数据流量的方法，其特征在于，所述方法包括：
    监测装置根据待监测的协议类型采集来自用户设备或互联网协议IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量，所述待监测的协议类型用于指示数据流量关联的应用；
    所述监测装置获取所述第一数据流量的流量信息，所述第一数据流量的流量信息包括第一数据量，所述第一数据量用于指示所述第一数据流量中所有报文的长度的总和；
    所述监测装置根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误；
    当所述监测装置确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述监测装置触发识别错误保护动作。
  2. 根据权利要求1所述的方法，其特征在于，所述监测装置根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误，包括：
    所述监测装置根据所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值大于第一预定偏差率，确定所述待监测的协议类型关联的所述第一数据流量存在识别错误，所述第一阈值为预设值。
  3. 根据权利要求1或2所述的方法，其特征在于，所述监测装置根据待监测的协议类型采集来自用户设备或互联网协议IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量，包括：所述监测装置根据待监测的协议类型采集第一预定时刻对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到所述第一数据流量；
    所述方法还包括：
    所述监测装置根据所述待监测的协议类型采集第二预定时刻对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第二数据流量，所述第一预定时刻和所述第二预定时刻为不同日期的相同时刻；
    所述监测装置获取所述第二数据流量的流量信息，所述第二数据流量的流量信息包括第二数据量，所述第二数据量用于指示所述第二数据流量中所有报文的长度的总和；
    所述监测装置根据所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，确定所述待监测的协议类型关联的所述第二数据流量是否存在识别错误，所述第二阈值为所述第一数据流量的流量信息的值；
    当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率时，所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误；
    当所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，所述监测装置触发识别错误保护动作。
  4. 根据权利要求1或2所述的方法，其特征在于，所述监测装置根据待监测的协议类型采集来自用户设备或互联网协议IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量，包括：所述监测装置根据待监测的协议类型采集第一预定时间间隔对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到所述第一数据流量；
    所述方法还包括：
    所述监测装置根据所述待监测的协议类型采集第二预定时间间隔对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第二数据流量，所述第一预定时间间隔的开始时刻和所述第二预定时间间隔的开始时刻为不同日期的相同时刻，所述第一预定时间间隔的结束时刻和所述第二预定时间间隔的结束时刻为不同日期的相同时刻；
    所述监测装置获取所述第二数据流量的流量信息，所述第二数据流量的流量信息包括第二数据量，所述第二数据量用于指示所述第二数据流量中所有报文的长度的总和；
    所述监测装置根据所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，确定所述待监测的协议类型关联的所述第二数据流量是否存在识别错误，所述第二阈值为所述第一数据流量的流量信息的值；
    当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率时，所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误；
    当所述监测装置确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，所述监测装置触发识别错误保护动作。
  5. 根据权利要求3或4所述的方法，其特征在于，所述方法还包括：
    当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值小于或等于所述第二预定偏差率时，所述监测装置确定所述待监测的协议类型关联的所述第二数据流量不存在识别错误；
    当所述监测装置确定所述待监测的协议类型关联的所述第二数据流量不存在识别错误时，所述监测装置将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值。
  6. 根据权利要求2所述的方法，其特征在于，
    所述第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量；
    所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值具体为：所述第一数据量的值相对于第一数据量阈值的偏差率的绝对值乘以第一权重与所述第一用户量的值相对于第一用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第一阈值包括所述第一数据量阈值和所述第一用户量阈值，所述第一权重与所述第二权重的和为1。
  7. 根据权利要求3或4所述的方法，其特征在于，
    所述第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量；
    所述第二数据流量的流量信息还包括第二用户量，所述第二用户量用于指示所述第二数据流量关联的用户数量；
    所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值具体为：所述第二数据量的值相对于第二数据量阈值的偏差率的绝对值乘以第一权重与所述第二用户量的值相对于第二用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第二阈值包括所述第二数据量阈值和所述第二用户量阈值，所述第二数据量阈值为所述第一数据流量的第一数据量的值，所述第二用户量阈值为所述第一数据流量的第一用户量的值，所述第一权重与所述第二权重的和为1。
  8. 根据权利要求5所述的方法，其特征在于，
    所述第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量；
    所述第二数据流量的流量信息还包括第二用户量，所述第二用户量用于指示所述第二数据流量关联的用户数量；
    所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值具体为：所述第二数据量的值相对于第二数据量阈值的偏差率的绝对值乘以第一权重与所述第二用户量的值相对于第二用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第二阈值包括所述第二数据量阈值和所述第二用户量阈值，所述第二数据量阈值为所述第一数据流量的第一数据量的值，所述第二用户量阈值为所述第一数据流量的第一用户量的值，所述第一权重与所述第二权重的和为1；
    所述监测装置将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值具体为：所述监测装置将所述第二数据量阈值更新为所述第二数据流量的第二数据量的值和所述第一数据流量的第一数据量的值的平均值，以及，所述监测装置将所述第二用户量阈值更新为所述第二数据流量的第二用户量的值和所述第一数据流量的第一用户量的值的平均值。
  9. 根据权利要求1-8中任一项所述的方法，其特征在于，
    所述识别错误保护动作包括以下动作中的至少一个：告警，流量放行，流量限流和流量阻断。
  10. 一种监测数据流量的监测装置，其特征在于，所述监测装置包括：
    采集单元，用于根据待监测的协议类型采集来自用户设备或互联网协议IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量，所述待监测的协议类型用于指示数据流量关联的应用；
    处理单元，用于获取所述第一数据流量的流量信息，所述第一数据流量的流量信息包括第一数据量，所述第一数据量用于指示所述第一数据流量中所有报文的长度的总和；
    所述处理单元还用于根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误；
    当所述处理单元确定所述待监测的协议类型关联的所述第一数据流量存在识别错误时，所述处理单元还用于触发识别错误保护动作。
  11. 根据权利要求10所述的监测装置，其特征在于，所述处理单元还用于在根据所述第一数据流量的流量信息确定所述待监测的协议类型关联的所述第一数据流量是否存在识别错误中，具体用于：
    根据所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值大于第一预定偏差率，确定所述待监测的协议类型关联的所述第一数据流量存在识别错误，所述第一阈值为预设值。
  12. 根据权利要求10或11所述的监测装置，其特征在于，所述采集单元用于在根据待监测的协议类型采集来自用户设备或互联网协议IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量中，具体用于：根据待监测的协议类型采集第一预定时刻对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到所述第一数据流量；
    所述采集单元还用于根据所述待监测的协议类型采集第二预定时刻对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第二数据流量，所述第一预定时刻和所述第二预定时刻为不同日期的相同时刻；
    所述处理单元还用于获取所述第二数据流量的流量信息，所述第二数据流量的流量信息包括第二数据量，所述第二数据量用于指示所述第二数据流量中所有报文的长度的总和；
    所述处理单元还用于根据所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，确定所述待监测的协议类型关联的所述第二数据流量是否存在识别错误，所述第二阈值为所述第一数据流量的流量信息的值；
    当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率时，所述处理单元还用于确定所述待监测的协议类型关联的所述第二数据流量存在识别错误；
    当所述处理单元确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，所述处理单元还用于触发识别错误保护动作。
  13. 根据权利要求10或11所述的监测装置，其特征在于，所述采集单元用于在根据待监测的协议类型采集来自用户设备或互联网协议IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第一数据流量中，具体用于：根据待监测的协议类型采集第一预定时间间隔对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到所述第一数据流量；
    所述采集单元还用于根据所述待监测的协议类型采集第二预定时间间隔对应的来自所述用户设备或所述IP网络的数据流量中所述待监测的协议类型关联的数据流量，得到第二数据流量，所述第一预定时间间隔的开始时刻和所述第二预定时间间隔的开 始时刻为不同日期的相同时刻，所述第一预定时间间隔的结束时刻和所述第二预定时间间隔的结束时刻为不同日期的相同时刻；
    所述处理单元还用于获取所述第二数据流量的流量信息，所述第二数据流量的流量信息包括第二数据量，所述第二数据量用于指示所述第二数据流量中所有报文的长度的总和；
    所述处理单元还用于根据所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值，确定所述待监测的协议类型关联的所述第二数据流量是否存在识别错误，所述第二阈值为所述第一数据流量的流量信息的值；
    当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值大于第二预定偏差率时，所述处理单元还用于确定所述待监测的协议类型关联的所述第二数据流量存在识别错误；
    当所述处理单元确定所述待监测的协议类型关联的所述第二数据流量存在识别错误时，所述处理单元还用于触发识别错误保护动作。
  14. 根据权利要求12或13所述的监测装置，其特征在于，
    当所述第二数据流量的流量信息的值相对于所述第二阈值的偏差率的绝对值小于或等于所述第二预定偏差率时，所述处理单元还用于确定所述待监测的协议类型关联的所述第二数据流量不存在识别错误；
    当所述处理单元确定所述待监测的协议类型关联的所述第二数据流量不存在识别错误时，所述处理单元还用于将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值。
  15. 根据权利要求11所述的监测装置，其特征在于，
    所述第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量；
    所述第一数据流量的流量信息的值相对于第一阈值的偏差率的绝对值具体为：所述第一数据量的值相对于第一数据量阈值的偏差率的绝对值乘以第一权重与所述第一用户量的值相对于第一用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第一阈值包括所述第一数据量阈值和所述第一用户量阈值，所述第一权重与所述第二权重的和为1。
  16. 根据权利要求12或13所述的监测装置，其特征在于，
    所述第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量；
    所述第二数据流量的流量信息还包括第二用户量，所述第二用户量用于指示所述第二数据流量关联的用户数量；
    所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值具体为：所述第二数据量的值相对于第二数据量阈值的偏差率的绝对值乘以第一权重与所述第二用户量的值相对于第二用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第二阈值包括所述第二数据量阈值和所述第二用户量阈值，所述第二数据量阈值为所述第一数据流量的第一数据量的值，所述第二用户量阈值为所述第一数据流量的第一 用户量的值，所述第一权重与所述第二权重的和为1。
  17. 根据权利要求14所述的监测装置，其特征在于，
    所述第一数据流量的流量信息还包括第一用户量，所述第一用户量用于指示所述第一数据流量关联的用户数量；
    所述第二数据流量的流量信息还包括第二用户量，所述第二用户量用于指示所述第二数据流量关联的用户数量；
    所述第二数据流量的流量信息的值相对于第二阈值的偏差率的绝对值具体为：所述第二数据量的值相对于第二数据量阈值的偏差率的绝对值乘以第一权重与所述第二用户量的值相对于第二用户量阈值的偏差率的绝对值乘以第二权重之和，其中，所述第二阈值包括所述第二数据量阈值和所述第二用户量阈值，所述第二数据量阈值为所述第一数据流量的第一数据量的值，所述第二用户量阈值为所述第一数据流量的第一用户量的值，所述第一权重与所述第二权重的和为1；
    所述处理单元用于在将所述第二阈值更新为所述第二数据流量的流量信息的值和所述第一数据流量的流量信息的值的平均值中，具体用于：将所述第二数据量阈值更新为所述第二数据流量的第二数据量的值和所述第一数据流量的第一数据量的值的平均值，以及，所述处理单元还用于将所述第二用户量阈值更新为所述第二数据流量的第二用户量的值和所述第一数据流量的第一用户量的值的平均值。
  18. 根据权利要求10-17中任一项所述的检测装置，其特征在于，
    所述识别错误保护动作包括以下动作中的至少一个：告警，流量放行，流量限流和流量阻断。
PCT/CN2017/111606 2017-05-23 2017-11-17 一种监测数据流量的方法、装置及系统 WO2018214424A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP17911049.9A EP3641222B1 (en) 2017-05-23 2017-11-17 Method, apparatus and system for monitoring data traffic
JP2019564804A JP6889784B2 (ja) 2017-05-23 2017-11-17 データトラフィックを監視するための方法、装置、およびシステム
KR1020197036914A KR102397346B1 (ko) 2017-05-23 2017-11-17 데이터 트래픽을 모니터링하기 위한 방법, 장치 및 시스템

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710370615.7A CN108933706B (zh) 2017-05-23 2017-05-23 一种监测数据流量的方法、装置及系统
CN201710370615.7 2017-05-23

Publications (1)

Publication Number Publication Date
WO2018214424A1 true WO2018214424A1 (zh) 2018-11-29

Family

ID=64395235

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/111606 WO2018214424A1 (zh) 2017-05-23 2017-11-17 一种监测数据流量的方法、装置及系统

Country Status (5)

Country Link
EP (1) EP3641222B1 (zh)
JP (1) JP6889784B2 (zh)
KR (1) KR102397346B1 (zh)
CN (1) CN108933706B (zh)
WO (1) WO2018214424A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115242621A (zh) * 2022-07-21 2022-10-25 北京天一恩华科技股份有限公司 网络专线监控方法、装置、设备及计算机可读存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110135861B (zh) * 2019-04-24 2024-03-05 平安科技（深圳）有限公司 信息通知方法、装置、计算机设备及存储介质
CN113542268B (zh) * 2021-07-14 2023-07-28 中能融合智慧科技有限公司 基于网络链路获取单个工控协议流量的方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101287010A (zh) * 2008-06-12 2008-10-15 华为技术有限公司 识别和验证消息协议类型的方法和装置
CN101431424A (zh) * 2008-12-12 2009-05-13 南京邮电大学 一种基于数据包的计费方法
WO2011060377A1 (en) * 2009-11-15 2011-05-19 Solera Networks, Inc. Method and apparatus for real time identification and recording of artifacts
CN105099821A (zh) * 2015-07-30 2015-11-25 北京奇虎科技有限公司 基于云的虚拟环境下流量监控的方法和装置

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE19820162A1 (de) 1998-05-05 1999-11-11 Klaus Ertmer Funktelekommunikationssystem und Verfahren zur Informationsspeicherung in einem Telekommunikationssystem
JP3994614B2 (ja) * 2000-03-13 2007-10-24 株式会社日立製作所 パケット交換機、ネットワーク監視システム及びネットワーク監視方法
US7433943B1 (en) * 2001-12-20 2008-10-07 Packeteer, Inc. Volume-based network management scheme
JP4679886B2 (ja) * 2004-11-24 2011-05-11 Ｋｄｄｉ株式会社 暗号化通信特徴抽出装置、暗号化通信特徴抽出プログラムおよび記録媒体
JP4518058B2 (ja) * 2006-01-11 2010-08-04 ソニー株式会社 コンテンツ伝送システム、コンテンツ伝送装置及びコンテンツ伝送方法、並びにコンピュータ・プログラム
JP2008085819A (ja) 2006-09-28 2008-04-10 Oki Electric Ind Co Ltd ネットワーク異常検出システム、ネットワーク異常検出方法及びネットワーク異常検出プログラム
KR101005856B1 (ko) * 2008-11-17 2011-01-05 한국과학기술원 전송 계층에서 트래픽을 분류하는 방법 및 장치
JP2011015253A (ja) * 2009-07-03 2011-01-20 Nippon Telegr & Teleph Corp <Ntt> 通信トラヒック分類方法、装置、およびプログラム
KR101087761B1 (ko) 2010-06-09 2011-11-30 고려대학교 산학협력단 스카이프 트래픽 데이터의 분류가 가능한 트래픽 분류 장치 및 방법
CN102821002B (zh) * 2011-06-09 2015-08-26 中国移动通信集团河南有限公司信阳分公司 网络流量异常检测方法和系统
JP4911737B1 (ja) * 2011-09-09 2012-04-04 株式会社アクティス 通信速度制御システム
CN103906136B (zh) * 2012-12-26 2018-01-30 中国移动通信集团内蒙古有限公司 一种数据业务流量管控方法和装置
US9078162B2 (en) * 2013-03-15 2015-07-07 DGS Global Systems, Inc. Systems, methods, and devices for electronic spectrum management
US9954743B2 (en) * 2013-08-12 2018-04-24 Hewlett Packard Enterprise Development Lp Application-aware network management
JP6541482B2 (ja) * 2015-07-13 2019-07-10 Kddi株式会社 検証装置、検証方法及び検証プログラム

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101287010A (zh) * 2008-06-12 2008-10-15 华为技术有限公司 识别和验证消息协议类型的方法和装置
CN101431424A (zh) * 2008-12-12 2009-05-13 南京邮电大学 一种基于数据包的计费方法
WO2011060377A1 (en) * 2009-11-15 2011-05-19 Solera Networks, Inc. Method and apparatus for real time identification and recording of artifacts
CN105099821A (zh) * 2015-07-30 2015-11-25 北京奇虎科技有限公司 基于云的虚拟环境下流量监控的方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3641222A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115242621A (zh) * 2022-07-21 2022-10-25 北京天一恩华科技股份有限公司 网络专线监控方法、装置、设备及计算机可读存储介质
CN115242621B (zh) * 2022-07-21 2024-01-02 北京天一恩华科技股份有限公司 网络专线监控方法、装置、设备及计算机可读存储介质

Also Published As

Publication number Publication date
KR20200007912A (ko) 2020-01-22
CN108933706A (zh) 2018-12-04
KR102397346B1 (ko) 2022-05-13
JP2020521395A (ja) 2020-07-16
EP3641222B1 (en) 2022-01-05
CN108933706B (zh) 2022-02-25
EP3641222A1 (en) 2020-04-22
JP6889784B2 (ja) 2021-06-18
EP3641222A4 (en) 2020-05-06

Similar Documents

Publication Publication Date Title
US10795992B2 (en) Self-adaptive application programming interface level security monitoring
WO2017113900A1 (zh) 网络流量中的应用信息的识别方法和装置
CN106778260B (zh) 攻击检测方法和装置
EP3704837B1 (en) Dynamic socket qos settings for web service (http) connections
US11829797B1 (en) Dynamic configuration of virtual machines
WO2017074472A1 (en) Network aware distributed business transaction anomaly detection
CN111258627B (zh) 一种接口文档生成方法和装置
WO2019051948A1 (zh) 监控数据的处理方法、设备、服务器及存储介质
US20120173712A1 (en) Method and device for identifying p2p application connections
WO2018214424A1 (zh) 一种监测数据流量的方法、装置及系统
US10848839B2 (en) Out-of-band telemetry data collection
CN111124819A (zh) 全链路监控的方法和装置
US20150227412A1 (en) Server performance correction using remote server actions
US20170126580A1 (en) Tracking Contention in a Distributed Business Transaction
CN112448969A (zh) 链路追踪方法、装置、系统、设备及可读存储介质
CN114070755B (zh) 虚拟机网络流量确定方法、装置、电子设备和存储介质
US10419351B1 (en) System and method for extracting signatures from controlled execution of applications and application codes retrieved from an application source
US20170223136A1 (en) Any Web Page Reporting and Capture
US10986474B2 (en) Methods of enabling flexible charging in M2M IOT service layer
WO2021155529A1 (zh) 资源删除方法、装置、设备及存储介质
US20170222904A1 (en) Distributed Business Transaction Specific Network Data Capture
CN112436969A (zh) 一种物联网设备管理方法、系统、设备及介质
JP2006067279A (ja) 侵入検知システム及び通信装置
KR20230100901A (ko) 엣지 서비스 관리 장치 및 그 제어방법
CN117950591A (zh) 网关的存储管理方法及装置、电子设备、存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17911049

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019564804

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017911049

Country of ref document: EP

Effective date: 20191202

ENP Entry into the national phase

Ref document number: 20197036914

Country of ref document: KR

Kind code of ref document: A